CVE-2021-27291: Debian Linux

High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days.

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Pygments Pygments: from 1.1, before 2.7.4 (fixed in 2.7.4)

Published 2021-03-17. Last modified 2026-06-17.