CVE-2021-27291: Pygments Regular Expression Denial of Service (ReDoS)
Summary
CVE-2021-27291: Pygments vulnerable to Regular Expression Denial of Service (ReDoS). Affects pygments versions >= 1.1, < 2.7.4. Fixed in 2.7.4. How to fix ↓
Also tracked for
- py3-pygments · Alpine:v3.11
The same CVE-2021-27291 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pygments is a syntax highlighting package that is widely used in programming languages. It provides lexers to parse code and apply syntax highlighting. The package relies heavily on regular expressions for this purpose. However, versions 1.1 and above of Pygments contain regular expressions with exponential or cubic worst-case complexity, making them vulnerable to ReDoS attacks. An attacker can exploit this vulnerability by crafting malicious input, leading to a denial of service.
Vulnerability Detail
The vulnerability in Pygments arises from the use of regular expressions with exponential or cubic worst-case complexity. These regular expressions can be exploited by an attacker to cause a denial of service by providing specially crafted input. The impact of this vulnerability is a complete halt of the affected Pygments instance, rendering it unusable. The vulnerability has been fixed in version 2.7.4 of Pygments.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "pygments==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.4
This is the first release that contains the fix.
pip install --upgrade "pygments==2.7.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, Pygments versions 1.1 and above are vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This can be exploited by an attacker to cause a denial of service by providing specially crafted input. To mitigate this vulnerability, it is recommended to update Pygments to version 2.7.4 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pygments →
FAQ
Pygments is a syntax highlighting package used in programming languages.
The vulnerability allows an attacker to cause a denial of service by providing malicious input, rendering the affected Pygments instance unusable.
To fix this vulnerability, update Pygments to version 2.7.4 or later by running 'pip install --upgrade pygments'.
No specific workaround is mentioned for this vulnerability.
You can find more information about this vulnerability in the Pygments advisory: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for pygments.
