{"action":"Upgrade pygments to 2.20.0 or later.","affected":[{"fixed":"2.20.0","introduced":"0"}],"component":"pygments","cve_ids":["CVE-2026-4539"],"ecosystem":"PyPI","epss":0.00159,"exploited":false,"fixed_versions":["2.20.0"],"ghsa_id":"GHSA-5239-wwwm-4pmq","id":"tcs_01M5KH2REZAZ17Y5NPK9GV6YFW","modified_at":"2026-07-13T16:32:42.870544840Z","published_at":"2026-07-13T14:36:44.333679Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2987","https://nvd.nist.gov/vuln/detail/CVE-2026-4539","https://github.com/pygments/pygments/issues/3058","https://github.com/pygments/pygments/pull/3064","https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc","https://github.com/pygments/pygments","https://github.com/pygments/pygments/releases/tag/2.20.0","https://vuldb.com/?ctiid.352327","https://vuldb.com/?id.352327","https://vuldb.com/?submit.774685","https://pypi.org/project/pygments","https://github.com/advisories/GHSA-5239-wwwm-4pmq"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-2987","url":"https://osv.dev/vulnerability/PYSEC-2026-2987"}],"summary":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching"}