GitHub Advisoryadvisory · PyPI

GHSA-pq64-v7f5-gqh8 Pygments vulnerable to Regular Expression Denial of Service (ReDoS)

HIGH Published 2021-03-29 Modified 2024-10-14 Official page ↗
Aliases
CVE-2021-27291
Ecosystem
PyPI
Packages
Pygments
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-03-22

Affected packages

• PyPI Pygments: >= 1.1, < 2.7.4 → fixed in 2.7.4

Description

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

Related

Alias · CVE (1)

  • CVE-2021-27291 In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References