CVE-2026-4539: Pygments DOS Vulnerability

CVE-2026-4539 Overview

A security vulnerability has been identified in Pygments, a widely-used Python syntax highlighting library. The flaw exists in the AdlLexer function within the file pygments/lexers/archetype.py, where inefficient regular expression complexity can lead to a Denial of Service (DoS) condition. This vulnerability allows a local attacker to craft malicious input that triggers catastrophic backtracking in the regex engine, consuming excessive CPU resources and potentially rendering the application unresponsive.

Critical Impact

Local attackers with access to systems running vulnerable versions of Pygments can cause resource exhaustion through specially crafted input processed by the AdlLexer, leading to application denial of service.

Affected Products

• Pygments up to version 2.19.2
• Applications and services utilizing Pygments for syntax highlighting
• Development environments and documentation generators relying on Pygments

Discovery Timeline

• 2026-03-22 - CVE-2026-4539 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-4539

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), specifically manifesting as an inefficient regular expression complexity issue, commonly known as Regular Expression Denial of Service (ReDoS). The vulnerable code resides in the AdlLexer class, which is responsible for parsing Archetype Definition Language (ADL) files used in clinical information modeling.

When the AdlLexer processes specially crafted input, the regular expression patterns employed can enter a state of catastrophic backtracking. This occurs when the regex engine exhaustively explores exponentially increasing matching possibilities before failing, consuming significant CPU cycles in the process.

The attack requires local access to the system, meaning an attacker must be able to supply input that will be processed by the vulnerable lexer. This could occur in scenarios where Pygments is used to highlight user-supplied code snippets, process uploaded files, or render documentation from untrusted sources.

Root Cause

The root cause of this vulnerability lies in the design of regular expression patterns within the AdlLexer implementation in pygments/lexers/archetype.py. The regex patterns contain constructs that lead to polynomial or exponential time complexity when processing certain input strings. Specifically, nested quantifiers or overlapping alternation groups create conditions where the regex engine must explore numerous unsuccessful matching paths before determining a match is impossible.

Attack Vector

The attack requires local access to a system running a vulnerable version of Pygments. An attacker can exploit this vulnerability by supplying crafted ADL content that triggers the inefficient regex behavior. Attack scenarios include:

• Submitting malicious code snippets to web applications that use Pygments for syntax highlighting
• Uploading files containing crafted content to documentation generators
• Providing specially crafted input through command-line tools utilizing Pygments

The exploit has been disclosed publicly through GitHub Issue #3058, making it accessible for potential malicious use. The Pygments project was notified of this issue but has not responded at the time of disclosure.

Detection Methods for CVE-2026-4539

Indicators of Compromise

• Abnormally high CPU utilization by Python processes running Pygments
• Application timeouts or unresponsiveness during syntax highlighting operations
• Increased processing time for ADL file parsing compared to baseline performance
• Log entries indicating processing failures for archetype-related content

Detection Strategies

• Monitor CPU usage patterns for Python applications utilizing Pygments, looking for sustained high utilization
• Implement application-level timeouts for syntax highlighting operations to detect and interrupt potential attacks
• Review application logs for repeated failures or timeouts associated with ADL content processing
• Deploy resource monitoring alerts that trigger when Pygments-related processes exceed normal thresholds

Monitoring Recommendations

• Establish baseline performance metrics for Pygments syntax highlighting operations in your environment
• Configure alerting for CPU consumption anomalies in services that process user-supplied code
• Implement input validation and size limits for content processed by Pygments
• Consider sandboxing Pygments operations with resource constraints to limit impact

How to Mitigate CVE-2026-4539

Immediate Actions Required

• Audit your environment to identify applications and services using Pygments version 2.19.2 or earlier
• Implement timeout mechanisms for Pygments lexer operations to prevent extended resource consumption
• Consider disabling or removing the AdlLexer if ADL syntax highlighting is not required
• Apply input validation and size restrictions on content processed by Pygments

Patch Information

As of the last update on 2026-03-23, no official patch has been released by the Pygments project. The vulnerability was reported through GitHub Issue #3058, but the project has not yet responded. Organizations should monitor the Pygments GitHub repository for updates and apply patches as soon as they become available.

Additional details about this vulnerability can be found at VulDB #352327.

Workarounds

• Disable or exclude the AdlLexer from Pygments if ADL syntax highlighting functionality is not required in your application
• Implement request timeouts and resource limits (CPU time, memory) for Pygments operations to contain potential DoS impact
• Validate and sanitize input before processing with Pygments, rejecting excessively large or suspicious content
• Consider using alternative syntax highlighters for ADL content until an official fix is released

# Example: Limiting Pygments resource usage with timeout
# Apply timeout to Pygments operations to prevent DoS
timeout 5s python -c "from pygments.lexers import get_lexer_by_name; lexer = get_lexer_by_name('adl')"

# Alternative: Use Python's resource module to limit CPU time
# Add to application startup to constrain Pygments processing
import resource
resource.setrlimit(resource.RLIMIT_CPU, (5, 10))  # 5 second soft limit, 10 second hard limit