StackRadar

CVE-2026-4539

Medium

Advisory

Published 22 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.002
5th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
180
of 17,781 indexed, latest versions
Container images
185
deployed by those charts
Fix available
1 of 2
affected packages

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Carried by container images the latest versions of 180 of 17,781 indexed charts deploy, on 185 images.

Affected packageAffected versionsFixed inImages
pygmentsdeb2.2.0+dfsg-1, 2.3.1+dfsg-1ubuntu2.2, 2.11.2+dfsg-2, 2.11.2+dfsg-2ubuntu0.1+2 moreno fix listed16
pygmentspypi2.2.0, 2.3.1, 2.4.2, 2.7.1+16 more2.20.0185
OSV records
DEBIAN-CVE-2026-4539GHSA-5239-wwwm-4pmqUBUNTU-CVE-2026-4539
Also known as
PYSEC-2026-2987

Charts affected

180 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
pygments@2.17.2
2.20.0

Open the chart page →

11,367
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
pygments@2.12.0
2.20.0

Open the chart page →

9,145
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.8.2d538416d5afe
pygments@2.3.1+dfsg-1ubuntu2.2
pygments@2.3.1
no fix listed
2.20.0

Open the chart page →

32,259
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
pygments@2.12.0
2.20.0

Open the chart page →

7,705
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
pygments@2.19.1
2.20.0

Open the chart page →

5,987
daskdask2024.1.11 of 2See more

dask dask 2024.1.1

1 of the 2 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
pygments@2.17.2
2.20.0

Open the chart page →

12,746
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
pygments@2.17.2
2.20.0

Open the chart page →

6,041
frigateblakeblackshear7.8.01 of 1See more

frigate blakeblackshear 7.8.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
pygments@2.18.0
2.20.0

Open the chart page →

3,004
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
pygments@2.19.1
2.20.0

Open the chart page →

17,245
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
pygments@2.19.2
2.20.0

Open the chart page →

1,339
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
pygments@2.7.1
2.20.0

Open the chart page →

52,919
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
pygments@2.17.2
2.20.0

Open the chart page →

14,094
taigarc-helm-charts0.1.01 of 7See more

taiga rc-helm-charts 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
taigaio/taiga-back:6.4.29f97323cc150
pygments@2.9.0
2.20.0

Open the chart page →

7,255
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
pygments@2.18.0
2.20.0

Open the chart page →

1,650
grafana-pdf-exporterwiremindVerified publisher2.1.11 of 1See more

grafana-pdf-exporter wiremind 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
pygments@2.14.0+dfsg-1
pygments@2.14.0
no fix listed
2.20.0

Open the chart page →

9,746
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
pygments@2.18.0
2.20.0

Open the chart page →

17,404
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
pygments@2.19.2
2.20.0

Open the chart page →

9,316
deconzgeek-cookbookVerified publisher6.5.21 of 1See more

deconz geek-cookbook 6.5.2

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
deconzcommunity/deconz:2.12.066541bbb78952
pygments@2.3.1
2.20.0

Open the chart page →

3,555
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
pygments@2.19.2
2.20.0

Open the chart page →

4,634
klancesklances0.1.41 of 1See more

klances klances 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/nicolargo/klances:0.1.374d6d33376eb
pygments@2.19.2
2.20.0

Open the chart page →

1,693
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
blacktop/httpie:latestfc5e68e2f5ab
pygments@2.2.0
2.20.0

Open the chart page →

6,868
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
kobotoolbox/kpi:2.022.24dbcacc01bccd4
pygments@2.11.2
2.20.0

Open the chart page →

18,517
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
pygments@2.19.2
2.20.0

Open the chart page →

3,804
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
pygments@2.19.2
2.20.0

Open the chart page →

12,037
anteonanteonVerified publisher2.6.43 of 13See more

anteon anteon 2.6.4

3 of the 13 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
pygments@2.18.0
2.20.0
ddosify/selfhosted_backend:3.2.93c11e3182652
pygments@2.18.0
2.20.0
ddosify/selfhosted_hammermanager:2.0.2b796b8c73011
pygments@2.18.0
2.20.0

Open the chart page →

22,202
squestchristianhuthVerified publisher6.6.71 of 4See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
pygments@2.18.0
2.20.0

Open the chart page →

9,971
tensorflow-notebookcloudnativeapp0.1.21 of 1See more

tensorflow-notebook cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
tensorflow/tensorflow:1.6.0-devel1e3172090703
pygments@2.2.0
2.20.0

Open the chart page →

36,094
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
pygments@2.17.2
2.20.0

Open the chart page →

11,205
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
pygments@2.18.0
2.20.0

Open the chart page →

13,761
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
pygments@2.16.1
2.20.0

Open the chart page →

1,944
kubedashdevopstalesOfficialVerified publisher4.0.01 of 8See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
devopstales/kubedash:3.1.08bb837da5aec
pygments@2.19.1
2.20.0

Open the chart page →

9,205
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
pygments@2.19.2
2.20.0

Open the chart page →

8,496
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
pygments@2.19.1
2.20.0

Open the chart page →

1,965
appdaemongeek-cookbookVerified publisher8.4.21 of 1See more

appdaemon geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
acockburn/appdaemon:4.0.83a93281d7e94
pygments@2.8.1
2.20.0

Open the chart page →

3,461
deepstackgeek-cookbookVerified publisher1.5.21 of 2See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
robmarkcole/deepstack-ui:latest410275726459
pygments@2.10.0
2.20.0

Open the chart page →

5,305
IMgrycapOfficialVerified publisher1.8.01 of 3See more

IM grycap 1.8.0

1 of the 3 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/grycap/im:latest06a16d4f279f
pygments@2.19.2
2.20.0

Open the chart page →

4,132
haproxy-redis-sentinelhaproxy-redis-sentinelVerified publisher0.1.31 of 2See more

haproxy-redis-sentinel haproxy-redis-sentinel 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/parmincloud/haproxy-redis-sentinel:1.0.040a00a6456ae
pygments@2.18.0
2.20.0

Open the chart page →

4,277
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
pygments@2.14.0+dfsg-1
pygments@2.14.0
no fix listed
2.20.0

Open the chart page →

6,374
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
pygments@2.18.0
2.20.0

Open the chart page →

16,514
hpe-greenlake-file-csi-driverhpe-storageVerified publisher2.6.41 of 7See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
pygments@2.18.0
2.20.0

Open the chart page →

6,095
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
pygments@2.19.2
2.20.0

Open the chart page →

12,397
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
pygments@2.17.2
2.20.0

Open the chart page →

15,712
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
pygments@2.19.2
2.20.0

Open the chart page →

11,764
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
salehmir/jesse:1.10.101afa95f979e9
pygments@2.19.2
2.20.0

Open the chart page →

3,421
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
pygments@2.18.0
2.20.0

Open the chart page →

20,403
kubeseal-webguikubeseal-webgui6.0.41 of 2See more

kubeseal-webgui kubeseal-webgui 6.0.4

1 of the 2 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/jaydee94/kubeseal-webgui/api:4.5.33cceb9462ae1
pygments@2.19.1
2.20.0

Open the chart page →

4,095
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
pygments@2.19.2
2.20.0

Open the chart page →

4,292
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
pygments@2.19.2
2.20.0

Open the chart page →

7,201
helm-taigamvitale1989-helm-taigaVerified publisher0.2.51 of 2See more

helm-taiga mvitale1989-helm-taiga 0.2.5

1 of the 2 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
pygments@2.2.0
2.20.0

Open the chart page →

5,104
open-notificatiesopen-zaak0.7.01 of 4See more

open-notificaties open-zaak 0.7.0

1 of the 4 container images this version deploys carry CVE-2026-4539.

Container imageDigestPackageFixed in
openzaak/open-notificaties:1.3.02e65313b9b10
pygments@2.4.2
2.20.0

Open the chart page →

2,850

Container images carrying it

185 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
pygments@2.19.2
2.20.0
1
flanksource/batch-runner:v1.0.44689687a7cf95
pygments@2.19.2
2.20.0
1
fluent/fluent-bit:4.0-debuge76397ef3983
pygments@2.14.0+dfsg-1
pygments@2.14.0
no fix listed
2.20.0
1
flyway/flyway:9.1545b5d7cdc75a
pygments@2.14.0
2.20.0
1
flyway/flyway:9.14.1-alpine80f12c80502b
pygments@2.14.0
2.20.0
1
fossology/fossology:4.2.18bd1f22ba7bb
pygments@2.13.0
2.20.0
1
galaxy/galaxy-init:v18.010267bad550e6
pygments@2.2.0
2.20.0
1
gethue/hue:4.11.011b649636e68
pygments@2.14.0
2.20.0
1
gethue/hue:4.10.05702b2c37ff9
pygments@2.9.0
2.20.0
1
gethue/hue:latest7d5c1b9f8a79
pygments@2.19.2
2.20.0
1
heartexlabs/label-studio:latestaa461572e8f9
pygments@2.16.1
2.20.0
1
hjacobs/kube-web-view:23.8.0431f1bf013d0
pygments@2.15.1
2.20.0
1
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
pygments@2.7.1
2.20.0
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
pygments@2.16.1
2.20.0
1
homeassistant/home-assistant:2023.12.48d000332b09b
pygments@2.17.2
2.20.0
1
improwised/erpnext-worker:v13.4.197280b55cbd4
pygments@2.9.0
2.20.0
1
jmferrer/azure-devops-agent:latest030f68ec6998
pygments@2.4.2
2.20.0
1
jonasal/devpi-server:6.17.0-alpineec1eee99a18d
pygments@2.19.2
2.20.0
1
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
pygments@2.16.1
2.20.0
1
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
pygments@2.7.1
2.20.0
1
knspar/phronetis:0.1.4609499d2dc91a
pygments@2.19.2
2.20.0
1
knspar/phronetis-operator:0.1.60c4f0543ee58
pygments@2.19.1
2.20.0
1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
pygments@2.11.2
2.20.0
1
kyso/kyso-nbdime:latest4aa9d38ee81d
pygments@2.13.0
2.20.0
1
langgenius/dify-api:1.0.0066035f93856
pygments@2.19.1
2.20.0
1
langgenius/dify-api:0.6.11fca918260dd6
pygments@2.18.0
2.20.0
1
linuxserver/calibre-web:0.6.24241009026e6f
pygments@2.19.2
2.20.0
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
pygments@2.19.2
2.20.0
1
lmacka/snappass:2.1.293f5c048b7d4
pygments@2.19.2
2.20.0
1
localstack/localstack:3.19d278167f2b7
pygments@2.17.2
2.20.0
1
lsstsqre/sciplat-hub:latest5e0ade6bed1c
pygments@2.8.1
2.20.0
1
makersquad/harp-proxy:0.8.1a40dd258c527
pygments@2.14.0+dfsg-1
pygments@2.14.0
no fix listed
2.20.0
1
mediagis/nominatim:3.7c15e941485ef
pygments@2.3.1+dfsg-1ubuntu2.2
pygments@2.3.1
no fix listed
2.20.0
1
mediagis/nominatim:4.2d0eae7b51374
pygments@2.11.2+dfsg-2
pygments@2.11.2
no fix listed
2.20.0
1
mintproject/model-catalog-fastapi:7dd88dc5bf1fe6a6d4703ea0a077afee45cb256102260d20a21f
pygments@2.19.1
2.20.0
1
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
pygments@2.2.0
2.20.0
1
ncsapolyglot/converters-ebook-convert:latest438d82cdbdb5
pygments@2.2.0
2.20.0
1
netboxcommunity/netbox:v3.2.83d652dca5351
pygments@2.12.0
2.20.0
1
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
pygments@2.18.0
2.20.0
1
opea/asr:1.025dd26d9cd09
pygments@2.18.0
2.20.0
1
opea/chatqna:1.038c51b791efa
pygments@2.18.0
2.20.0
1
opea/codegen:1.058f91683892d
pygments@2.18.0
2.20.0
1
opea/codetrans:1.0e2436483b73d
pygments@2.18.0
2.20.0
1
opea/docsum:1.03eaa91849512
pygments@2.18.0
2.20.0
1
opea/guardrails-tgi:1.0262c6048aab8
pygments@2.18.0
2.20.0
1
opea/guardrails-tgi:latestf68bec6a1271
pygments@2.19.1
2.20.0
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
pygments@2.18.0
2.20.0
1
opea/speecht5:1.0249afad3d268
pygments@2.18.0
2.20.0
1
opea/tts:1.0257ae94709e9
pygments@2.18.0
2.20.0
1
opea/web-retriever-chroma:1.0fe08165d7770
pygments@2.18.0
2.20.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.