A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1667-1 advisory.

    - CVE-2026-4539: inefficient regex for GUID and ID pattern matching can lead to archetype lexer ReDoS     (bsc#1260796).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1666-1 advisory.

    - CVE-2026-4539: inefficient regex for GUID and ID pattern matching can lead to archetype lexer ReDoS     (bsc#1260796).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function     AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular     expression complexity. The attack is only possible with local access. The exploit has been released to the     public and may be used for attacks. The project was informed of the problem early through an issue report     but has not responded yet. (CVE-2026-4539)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
311749	SUSE SLED15 / SLES15 Security Update : python-Pygments (SUSE-SU-2026:1667-1)	Nessus	SuSE Local Security Checks	medium
311746	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Pygments (SUSE-SU-2026:1666-1)	Nessus	SuSE Local Security Checks	medium
305118	Photon OS 5.0: Python3 PHSA-2026-5.0-0802	Nessus	PhotonOS Local Security Checks	critical
303303	Linux Distros Unpatched Vulnerability : CVE-2026-4539	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-4539

medium

Tenable Plugins

medium

medium

critical

medium