Bug 2450066 (CVE-2026-4539)

Summary: CVE-2026-4539 pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abarbaro, adudiak, alinfoot, alizardo, anpicker, anthomas, aprice, bbrownin, bparees, caswilli, dfreiber, drow, dschmidt, dtrifiro, ebourniv, ehelms, erezende, ggainey, hasun, jburrell, jchui, jdobes, jfula, jhe, jkoehler, jlanda, jowilson, jsamir, juwatts, jwong, kaycoth, kgaikwad, kshier, ktsao, lball, lgallett, ljawale, lphiri, luizcosta, mbarnett, mhayden, mhulan, nboldt, ngough, nmoumoul, nweather, nyancey, oezr, omaciel, ometelka, orabin, osousa, pcreech, psrna, ptisnovs, rbobbitt, rbryant, rchan, sbunciak, sdoran, simaishi, smallamp, smcdonal, stcannon, syedriko, teagle, tmalecek, ttakamiy, veshanka, vkumar, weaton, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in pygments. A local user can exploit this vulnerability by providing specially crafted input to the AdlLexer function, which leads to inefficient regular expression processing. This can result in a Denial of Service (DoS), making the application unresponsive.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-03-22 06:01:42 UTC
A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.