CVE-2026-4539 pygments archetype.py AdlLexer redos
A local attacker can cause a denial of service in the Pygments library via inefficient regular expressions in the AdlLexer component.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4539?
CVE-2026-4539 is a medium-severity denial of service vulnerability in pygments, published on 22 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Which versions are affected by CVE-2026-4539?
3 open source packages ship an affected version, including pygments and Pygments.
| Package | Affected | Fixed in |
|---|---|---|
pygments PyPI | All versions | 2.20.0 |
pygments PyPI | All versions | 2.20.0 |
Pygments PyPI | All versions | 2.20.0 |
Linux distribution packages (5)
python-Pygments SUSE:Linux Enterprise Server 16.0 | All versions | 2.19.1-160000.3.1 |
python-Pygments SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.19.1-160000.3.1 |
python-Pygments SUSE:Linux Micro 6.2 | All versions | 2.19.1-160000.3.1 |
python-Pygments openSUSE:Leap 16.0 | All versions | 2.19.1-160000.3.1 |
python-Pygments openSUSE:Tumbleweed | All versions | 2.20.0-2.1 |
How do I fix CVE-2026-4539?
Upgrade pygments to 2.20.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-4539 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4539 exists.
Sources
Also known as CLEANSTART-2026-AU68896, CLEANSTART-2026-ER46931, DEBIAN-CVE-2026-4539, ECHO-c58f-806e-ab85, GHSA-5239-wwwm-4pmq, MGASA-2026-0090 and 26 more.