CVE-2021-20270

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

Published: Mar 23, 2021
Updated: May 9, 2024
CVE: CVE-2021-20270
GHSA: GHSA-9w8r-397f-prfh
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:N/A:P

CWEs:

CWE-835

Affected Software
References

Software	From	Fixed in
pygments / pygments	1.5	2.7.3.x
redhat / enterprise_linux	7.0	7.0.x
redhat / openshift_container_platform	3.11	3.11.x
redhat / enterprise_linux	8.0	8.0.x
redhat / openshift_container_platform	4.0	4.0.x
redhat / openstack_platform	10.0	10.0.x
fedoraproject / fedora	33	33.x
debian / debian_linux	9.0	9.0.x
debian / debian_linux	10.0	10.0.x
Pygments	1.5	2.7.4

https://bugzilla.redhat.com/show_bug.cgi?id=1922136
https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html
https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html
https://www.debian.org/security/2021/dsa-4889
https://www.oracle.com/security-alerts/cpuoct2021.html

Vulnerability Database

289,599

CVE-2021-20270