Bug 35318 - python-pygments new security issue CVE-2026-4539
Summary: python-pygments new security issue CVE-2026-4539
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2026-04-03 15:49 CEST by Nicolas Salguero
Modified: 2026-04-08 04:50 CEST (History)
4 users (show)

See Also:
Source RPM: python-pygments-2.15.1-1.mga9.src.rpm
CVE: CVE-2026-4539
Status comment:
andrewsfarm: test_passed_mga9_64+


Attachments

Nicolas Salguero 2026-04-03 15:51:04 CEST

Whiteboard: (none) => MGA9TOO
Status comment: (none) => Fixed upstream in 2.20.0 and patch available from upstream
Flags: (none) => affects_mga9+
Source RPM: (none) => python-pygments-2.19.1-3.mga10.src.rpm, python-pygments-2.15.1-1.mga9.src.rpm
CVE: (none) => CVE-2026-4539

Comment 1 Marja Van Waes 2026-04-04 19:42:14 CEST
Assigning to the Python Stack maintainers.

CC: (none) => marja11
Assignee: bugsquad => python

Comment 2 Nicolas Salguero 2026-04-07 15:06:33 CEST
For Cauldron, python-pygments-2.19.1-4.mga10 fixes that issue.


Suggested advisory:
========================

The updated package fixes a security vulnerability:

Pygments archetype.py AdlLexer redos. (CVE-2026-4539)

References:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/EBSMTYMFOHFBVTCLFPVRVEOWXXCIDDMI/
========================

Updated package in core/updates_testing:
========================
python3-pygments-2.15.1-1.1.mga9

from SRPM:
python-pygments-2.15.1-1.1.mga9.src.rpm

Assignee: python => qa-bugs
Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)
Status comment: Fixed upstream in 2.20.0 and patch available from upstream => (none)
Flags: affects_mga9+ => (none)
Source RPM: python-pygments-2.19.1-3.mga10.src.rpm, python-pygments-2.15.1-1.mga9.src.rpm => python-pygments-2.15.1-1.mga9.src.rpm
Status: NEW => ASSIGNED

Comment 3 Thomas Andrews 2026-04-07 22:09:15 CEST
MGA9-64 Plasma. No installation issues.

Referenced Bug 17331 for tests, using the script that had been corrected for python3:

$ python3 testscript.py
<div class="highlight"><pre><span></span><span class="nb">print</span> <span class="s2">&quot;Hello World&quot;</span>
</pre></div>

$ pygmentize testscript.py
from pygments import highlight
from pygments.lexers import PythonLexer
from pygments.formatters import HtmlFormatter

code = 'print "Hello World"'
print(highlight(code, PythonLexer(), HtmlFormatter()))

With text from the second command now highlighted in different colors.

Looks OK here.

Validating the update.

Flags: (none) => test_passed_mga9_64+
Keywords: (none) => validated_update
Whiteboard: (none) => MGA9-64-OK
CC: (none) => andrewsfarm, sysadmin-bugs

katnatek 2026-04-08 02:53:16 CEST

Keywords: (none) => advisory

Comment 4 Dan Fandrich 2026-04-08 04:05:06 CEST
N.B. I couldn't make sense of the vulnerability description so I reworded it based on https://vuldb.com/vuln/352327

CC: (none) => dan

Comment 5 Mageia Robot 2026-04-08 04:50:08 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2026-0090.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.