A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

According to the versions of the python-pygments packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function     AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular     expression complexity. The attack is only possible with local access. The exploit has been released to the     public and may be used for attacks. The project was informed of the problem early through an issue report     but has not responded yet.(CVE-2026-4539)

Tenable has extracted the preceding description block directly from the EulerOS python-pygments security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20931-1 advisory.

    This update for python-Pygments fixes the following issue:

    - CVE-2026-4539: Denial of Service via inefficient regular expression processing in AdlLexer     (bsc#1260796).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1667-1 advisory.

    - CVE-2026-4539: inefficient regex for GUID and ID pattern matching can lead to archetype lexer ReDoS     (bsc#1260796).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1666-1 advisory.

    - CVE-2026-4539: inefficient regex for GUID and ID pattern matching can lead to archetype lexer ReDoS     (bsc#1260796).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function
    AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular
    expression complexity. The attack is only possible with local access. The exploit has been released to the
    public and may be used for attacks. The project was informed of the problem early through an issue report
    but has not responded yet. (CVE-2026-4539)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function     AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular     expression complexity. The attack is only possible with local access. The exploit has been released to the     public and may be used for attacks. The project was informed of the problem early through an issue report     but has not responded yet. (CVE-2026-4539)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326165	EulerOS 2.0 SP12 : python-pygments (EulerOS-SA-2026-2622)	Nessus	Huawei Local Security Checks	medium
326163	EulerOS 2.0 SP12 : python-pygments (EulerOS-SA-2026-2562)	Nessus	Huawei Local Security Checks	medium
323208	EulerOS 2.0 SP15 : python-pygments (EulerOS-SA-2026-2505)	Nessus	Huawei Local Security Checks	medium
323162	EulerOS 2.0 SP15 : python-pygments (EulerOS-SA-2026-2464)	Nessus	Huawei Local Security Checks	medium
321004	openSUSE 16 Security Update : python-Pygments (openSUSE-SU-2026:20931-1)	Nessus	SuSE Local Security Checks	medium
320268	EulerOS 2.0 SP13 : python-pygments (EulerOS-SA-2026-2312)	Nessus	Huawei Local Security Checks	medium
320247	EulerOS 2.0 SP13 : python-pygments (EulerOS-SA-2026-2355)	Nessus	Huawei Local Security Checks	medium
311749	SUSE SLED15 / SLES15 Security Update : python-Pygments (SUSE-SU-2026:1667-1)	Nessus	SuSE Local Security Checks	medium
311746	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Pygments (SUSE-SU-2026:1666-1)	Nessus	SuSE Local Security Checks	medium
305118	Photon OS 5.0: Python3 PHSA-2026-5.0-0802	Nessus	PhotonOS Local Security Checks	critical
439448	SCA: security update for Pygments (GHSA-5239-wwwm-4pmq)	Tenable Cloud Security	SCA Checks	medium
439448	SCA: security update for Pygments (GHSA-5239-wwwm-4pmq)	Tenable Self-Hosted Container Security	SCA Checks	medium
303303	Linux Distros Unpatched Vulnerability : CVE-2026-4539	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-4539

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium