openSUSE has issued an advisory on April 2: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/EBSMTYMFOHFBVTCLFPVRVEOWXXCIDDMI/ Fixed by: https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc (2.20.0)
Whiteboard: (none) => MGA9TOOStatus comment: (none) => Fixed upstream in 2.20.0 and patch available from upstreamFlags: (none) => affects_mga9+Source RPM: (none) => python-pygments-2.19.1-3.mga10.src.rpm, python-pygments-2.15.1-1.mga9.src.rpmCVE: (none) => CVE-2026-4539
Assigning to the Python Stack maintainers.
CC: (none) => marja11Assignee: bugsquad => python
For Cauldron, python-pygments-2.19.1-4.mga10 fixes that issue. Suggested advisory: ======================== The updated package fixes a security vulnerability: Pygments archetype.py AdlLexer redos. (CVE-2026-4539) References: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/EBSMTYMFOHFBVTCLFPVRVEOWXXCIDDMI/ ======================== Updated package in core/updates_testing: ======================== python3-pygments-2.15.1-1.1.mga9 from SRPM: python-pygments-2.15.1-1.1.mga9.src.rpm
Assignee: python => qa-bugsVersion: Cauldron => 9Whiteboard: MGA9TOO => (none)Status comment: Fixed upstream in 2.20.0 and patch available from upstream => (none)Flags: affects_mga9+ => (none)Source RPM: python-pygments-2.19.1-3.mga10.src.rpm, python-pygments-2.15.1-1.mga9.src.rpm => python-pygments-2.15.1-1.mga9.src.rpmStatus: NEW => ASSIGNED
MGA9-64 Plasma. No installation issues. Referenced Bug 17331 for tests, using the script that had been corrected for python3: $ python3 testscript.py <div class="highlight"><pre><span></span><span class="nb">print</span> <span class="s2">"Hello World"</span> </pre></div> $ pygmentize testscript.py from pygments import highlight from pygments.lexers import PythonLexer from pygments.formatters import HtmlFormatter code = 'print "Hello World"' print(highlight(code, PythonLexer(), HtmlFormatter())) With text from the second command now highlighted in different colors. Looks OK here. Validating the update.
Flags: (none) => test_passed_mga9_64+Keywords: (none) => validated_updateWhiteboard: (none) => MGA9-64-OKCC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => advisory
N.B. I couldn't make sense of the vulnerability description so I reworded it based on https://vuldb.com/vuln/352327
CC: (none) => dan
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2026-0090.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED