Vulnerabilities > CVE-2021-27291

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
pygments
debian
fedoraproject
NVD
Published: 2021-03-17
Updated: 2024-11-21

Summary

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

Vulnerable Configurations

Part Description Count
Application
Pygments
10
OS
Debian
2
OS
Fedoraproject
2

References