CVE-2021-20270: Pygments SMLLexer DoS Vulnerability

CVE-2021-20270 Overview

An infinite loop vulnerability exists in the SMLLexer component of Pygments, a widely-used syntax highlighting library for Python. When processing Standard ML (SML) source files, the lexer can enter an infinite loop, leading to denial of service conditions. This vulnerability affects Pygments versions 1.5 through 2.7.3 and can be triggered with minimal input containing only the "exception" keyword.

Critical Impact

Applications using Pygments for syntax highlighting of user-supplied SML code are vulnerable to denial of service attacks that can exhaust server resources and cause service disruption.

Affected Products

• Pygments versions 1.5 to 2.7.3
• Red Hat OpenShift Container Platform 3.11 and 4.0
• Red Hat OpenStack Platform 10.0
• Red Hat Software Collections
• Red Hat Enterprise Linux 7.0 and 8.0
• Fedora 33
• Debian Linux 9.0 and 10.0

Discovery Timeline

• 2021-03-23 - CVE CVE-2021-20270 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-20270

Vulnerability Analysis

The vulnerability resides in the SMLLexer class within the Pygments library, which is responsible for tokenizing and highlighting Standard ML source code. Due to a flaw in the lexer's regex patterns or state machine logic, certain input sequences cause the lexer to enter an infinite loop rather than properly terminating the tokenization process.

The issue is classified under CWE-835 (Loop with Unreachable Exit Condition), indicating that the lexer's processing loop lacks proper termination conditions for specific edge-case inputs. This makes the vulnerability particularly dangerous in web applications that accept user-supplied code for syntax highlighting, as an attacker can craft minimal payloads to trigger the condition.

Root Cause

The root cause is an improperly designed state machine in the SMLLexer that fails to advance or exit when encountering certain token sequences. Specifically, when the lexer processes input containing only the exception keyword, it becomes trapped in a processing state with no valid exit path. This is a classic example of inadequate input boundary handling in parser implementations.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by submitting crafted SML code to any application that uses Pygments for syntax highlighting. The attack requires minimal payload complexity—as simple as a single keyword—making it trivially exploitable.

The vulnerability can be triggered in any context where Pygments processes user-controlled input:

• Documentation platforms with code highlighting
• Code review and collaboration tools
• CI/CD pipelines generating syntax-highlighted reports
• Web applications with code paste functionality

The malicious input that triggers the infinite loop is remarkably simple—a file containing only the exception keyword is sufficient to cause the denial of service condition. This low barrier to exploitation significantly increases the risk for affected deployments.

Detection Methods for CVE-2021-20270

Indicators of Compromise

• Abnormally high CPU utilization on processes running Pygments
• Application timeouts or hangs when processing SML-formatted code
• Memory consumption increases in web workers or application processes handling syntax highlighting
• Log entries showing request timeouts for code highlighting endpoints

Detection Strategies

• Monitor CPU usage patterns for processes that invoke Pygments highlighting functionality
• Implement request timeout monitoring for code processing endpoints
• Deploy application performance monitoring (APM) to detect long-running syntax highlighting operations
• Audit application dependencies to identify vulnerable Pygments versions (1.5 through 2.7.3)

Monitoring Recommendations

• Set up alerts for sustained high CPU usage in application workers
• Configure timeout thresholds for syntax highlighting operations
• Implement resource quotas for processes handling user-submitted code
• Monitor for repeated requests with SML content type from single sources

How to Mitigate CVE-2021-20270

Immediate Actions Required

• Upgrade Pygments to version 2.7.4 or later immediately
• Implement input validation to restrict or sanitize SML file processing
• Add timeout mechanisms for all syntax highlighting operations
• Consider disabling SML highlighting if not required by your application

Patch Information

The vulnerability is addressed in Pygments version 2.7.4 and later. Organizations should update their Pygments installations through their package manager. For detailed patch information, refer to the Red Hat Bug Report and the Debian Security Advisory DSA-4889.

Additional vendor advisories are available from Debian LTS and Oracle CPU October 2021.

Workarounds

• Implement processing timeouts for all syntax highlighting operations
• Restrict accepted input languages to exclude SML until patched
• Deploy rate limiting on code submission endpoints
• Run Pygments processing in isolated sandboxed environments with resource limits

# Upgrade Pygments to patched version
pip install --upgrade pygments>=2.7.4

# Verify installed version
pip show pygments | grep Version