p PatchFirst

CVE-2026-4539

CVE-2026-4539 · pygments archetype.py AdlLexer redos

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.8 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pygments

    Versions
    • 2.19.0: Affected
    • 2.19.1: Affected
    • 2.19.2: Affected

    No fix published

  • pygments Debian:12

    Versions
    • 2.14.0+dfsg-1
    • 2.15.0+dfsg-1
    • 2.15.1+dfsg-1
    • 2.17.2+dfsg-1
    • 2.18.0+dfsg-1
    • 2.18.0+dfsg-2
    • 2.19.2+dfsg-1
    • 2.20.0+dfsg-1
    • 2.20.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pygments Debian:13

    Versions
    • 2.18.0+dfsg-2
    • 2.19.2+dfsg-1
    • 2.20.0+dfsg-1
    • 2.20.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pygments Debian:14

    Versions
    • 2.18.0+dfsg-2
    • 2.19.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 2.20.0+dfsg-1

    Update to 2.20.0+dfsg-1

  • pygments PyPI

    Versions
    • 0.10
    • 0.11
    • 0.11.1
    • 0.5
    • 0.5.1
    • 0.6
    • 0.7
    • 0.7.1
    • 0.8
    • 0.8.1
    • 0.9
    • 1.0
    • 1.1
    • 1.1.1
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.3
    • 1.3.1
    • 1.4
    • 1.5
    • 1.6
    • 1.6rc1
    • 2.0
    • 2.0.1
    • 2.0.2
    • 2.0rc1
    • 2.1
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.10.0
    • 2.11.0
    • 2.11.1
    • 2.11.2
    • 2.12.0
    • 2.13.0
    • 2.14.0
    • 2.15.0
    • 2.15.1
    • 2.16.0
    • 2.16.1
    • 2.17.0
    • 2.17.1
    • 2.17.2
    • 2.18.0
    • 2.19.0
    • 2.19.1
    • 2.19.2
    • 2.2.0
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.1
    • 2.5.2
    • 2.6.0
    • 2.6.1
    • 2.7.0
    • 2.7.1
    • 2.7.2
    • 2.7.3
    • 2.7.4
    • 2.8.0
    • 2.8.1
    • 2.9.0
    Affected ranges
    • ECOSYSTEM: < 2.20.0

    Update to 2.20.0

  • pygments Ubuntu:Pro:14.04:LTS

    Versions
    • 1.6+dfsg-1
    • 1.6+dfsg-1build1
    • 1.6+dfsg-1ubuntu1
    • 1.6+dfsg-1ubuntu1.1
    • 1.6+dfsg-1ubuntu1.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pygments Ubuntu:16.04:LTS

    Versions
    • 2.0.1+dfsg-1.1svn1
    • 2.0.1+dfsg-1.1ubuntu1
    • 2.1+dfsg-1
    • 2.1+dfsg-1ubuntu0.1
    • 2.1+dfsg-1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pygments Ubuntu:18.04:LTS

    Versions
    • 2.2.0+dfsg-1
    • 2.2.0+dfsg-1ubuntu0.1
    • 2.2.0+dfsg-1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pygments Ubuntu:20.04:LTS

    Versions
    • 2.3.1+dfsg-1ubuntu1
    • 2.3.1+dfsg-1ubuntu2
    • 2.3.1+dfsg-1ubuntu2.1
    • 2.3.1+dfsg-1ubuntu2.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pygments Ubuntu:22.04:LTS

    Versions
    • 2.7.1+dfsg-2.1
    • 2.10.0+dfsg-1
    • 2.11.2+dfsg-2
    • 2.11.2+dfsg-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pygments Ubuntu:24.04:LTS

    Versions
    • 2.15.1+dfsg-1
    • 2.17.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pygments Ubuntu:25.10

    Versions
    • 2.18.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pygments Ubuntu:26.10

    Versions
    • 2.19.2+dfsg-1
    • 2.20.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pygments Ubuntu:26.04:LTS

    Versions
    • 2.18.0+dfsg-2
    • 2.18.0+dfsg-2build1
    • 2.19.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →