What’s Vulnerable › Vulnerabilities

CVE-2021-20270

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-23 · updated 2026-06-17
• Weakness: CWE-835

Description

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

Affected products

• Debian Linux: 9.0, 10.0
• Fedoraproject Fedora: 33
• Pygments: from 1.5 through 2.7.3
• Red Hat Enterprise Linux: 7.0, 8.0
• Red Hat OpenShift Container Platform 4.18: 3.11, 4.0
• nova_libvirt container provided by the Red Hat OpenStack Platform: 10.0
• RedHat Software Collections: all versions

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1922136
• https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html
• https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html
• https://www.debian.org/security/2021/dsa-4889
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1922136
• https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html
• https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html
• https://www.debian.org/security/2021/dsa-4889
• https://www.oracle.com/security-alerts/cpuoct2021.html

Get alerted when CVE-2021-20270 or the next vulnerability affects your stack