GHSA-9w8r-397f-prfh CVE-2021-20270 PYSEC-2021-140
Infinite Loop in Pygments
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 2.76%
- Chance of exploitation in the next 30 days. Higher than 86.26% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
2.7.4- Upgrade pygments to this version or later
Description
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| pygments | >= 1.5, < 2.7.4 |
2.7.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pygments PyPI → 2.7.4
- pip
pip install --upgrade "pygments>=2.7.4"- poetry
poetry add "pygments>=2.7.4"- uv
uv add "pygments>=2.7.4"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Packages
Other links
- github.com/pygments/pygments/commit/f91804ff4772e3ab41f46e28d370f57898700333
- bugzilla.redhat.com/show_bug.cgi
- github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2021-140.yaml
- lists.debian.org/debian-lts-announce/2021/05/msg00003.html
- lists.debian.org/debian-lts-announce/2021/05/msg00006.html
- debian.org/security/2021/dsa-4889
- oracle.com/security-alerts/cpuoct2021.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5239-wwwm-4pmq Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching | Low | Also affects pygments |
| GHSA-mrwq-x4v8-fh7p Pygments vulnerable to ReDoS | Medium | Also affects pygments |
| GHSA-pq64-v7f5-gqh8 Pygments vulnerable to Regular Expression Denial of Service (ReDoS) | High | Also affects pygments |
| GHSA-fff8-4w9p-7v76 Command Injection in Pygments | Critical | Also affects pygments |
| GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | High | Same weakness, CWE-835 |
| GHSA-mfr5-77xh-9j7h pypdf has possible infinite loop when cloning dictionaries | High | Same weakness, CWE-835 |
| GHSA-h6cr-wjv9-3cpp Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) | Low | Same weakness, CWE-835 |
| GHSA-fw5c-8223-6h42 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) | Medium | Same weakness, CWE-835 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor