PyPI/pygments CVE-2026-4539: low 3.3, EPSS 0.16%
Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
Action: Upgrade pygments to 2.20.0 or later.
pip install pygments==2.20.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.20.0 | - |
Fixed versions
| 2.20.0 |
Sources
- osv: GHSA-5239-wwwm-4pmq
- https://nvd.nist.gov/vuln/detail/CVE-2026-4539
- https://github.com/pygments/pygments/issues/3058
- https://github.com/pygments/pygments/pull/3064
- https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc
- https://github.com/pygments/pygments
- https://github.com/pygments/pygments/releases/tag/2.20.0
- https://vuldb.com/?ctiid.352327
- https://vuldb.com/?id.352327
- https://vuldb.com/?submit.774685
CVE-2026-4539 · published · modified · JSON