CVE-2026-4539

Medium

Advisory

Published 22 Mar 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.8; base score, highest
EPSS: 0.002; 5th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 180; of 17,781 indexed, latest versions
Container images: 185; deployed by those charts
Fix available: 1 of 2; affected packages

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Carried by container images the latest versions of 180 of 17,781 indexed charts deploy, on 185 images.

Affected package	Affected versions	Fixed in	Images
pygmentsdeb	2.2.0+dfsg-1, 2.3.1+dfsg-1ubuntu2.2, 2.11.2+dfsg-2, 2.11.2+dfsg-2ubuntu0.1+2 more	no fix listed	16
pygmentspypi	2.2.0, 2.3.1, 2.4.2, 2.7.1+16 more	2.20.0	185

OSV records: DEBIAN-CVE-2026-4539 GHSA-5239-wwwm-4pmq UBUNTU-CVE-2026-4539
Also known as: PYSEC-2026-2987

Charts affected

180 by stars

Chart

Latest

Affected images

Radar Score

reviewboardrock8s

0.0.1

1 of 3 See more

reviewboard rock8s 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
beanbag/reviewboard :latest	6b840f546e1c	pygments@2.19.2	2.20.0

Open the chart page →

6,084

ai-agentromholdings

0.0.1

1 of 1 See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
quay.io/devtron/ai-agent :0.0.1	6545dac92173	pygments@2.18.0	2.20.0

Open the chart page →

9,607

rommromm-helm-chart

1.5.5

1 of 3 See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
rommapp/romm :5.2.0	3512f2ca4557	pygments@2.19.2	2.20.0

Open the chart page →

3,370

imgtagrotational

0.2.0

1 of 1 See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
gcr.io/rotationalio-habanero/imgtag :89ec287	a534a3170d03	pygments@2.19.1	2.20.0

Open the chart page →

3,312

paperless-ngxrtomik-helm-charts

0.0.5

1 of 1 See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	pygments@2.19.2	2.20.0

Open the chart page →

10,605

airflowsb-helm-charts

0.3.0

1 of 1 See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
apache/airflow :2.8.1	e5560ad0b86e	pygments@2.17.2	2.20.0

Open the chart page →

10,209

pgadminsb-helm-charts

0.3.0

1 of 1 See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :8.13	561c1f8f99f2	pygments@2.18.0	2.20.0

Open the chart page →

1,713

showroom-docs-mcpshowroom-docs-mcp

2.1.0

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pygments@2.19.2	2.20.0

Open the chart page →

5,201

testing-multitoolsomeblackmagic

0.1.2

1 of 1 See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
someblackmagic/k8s-testing-multitool :v0.1.0	6eca64b6b440	pygments@2.3.1+dfsg-1ubuntu2.2 pygments@2.3.1	no fix listed 2.20.0

Open the chart page →

30,687

studygovernorstudy-governor

0.1.38

1 of 3 See more

studygovernor study-governor 0.1.38

1 of the 3 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	pygments@2.13.0	2.20.0

Open the chart page →

1,447

rundecksvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	pygments@2.12.0	2.20.0

Open the chart page →

18,756

asrtest-opea

1.0.0

1 of 1 See more

4,393

chatqnatest-opea

1.0.0

5 of 11 See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/chatqna :1.0	38c51b791efa	pygments@2.18.0	2.20.0
opea/embedding-tei :1.0	5c9639de61c1	pygments@2.18.0	2.20.0
opea/llm-tgi :1.0	0c25aab3f106	pygments@2.18.0	2.20.0
opea/reranking-tei :1.0	e48613afb191	pygments@2.18.0	2.20.0
opea/retriever-redis :1.0	eb746b263705	pygments@2.18.0	2.20.0

Open the chart page →

39,090

codegentest-opea

1.0.0

2 of 5 See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/codegen :1.0	58f91683892d	pygments@2.18.0	2.20.0
opea/llm-tgi :1.0	0c25aab3f106	pygments@2.18.0	2.20.0

Open the chart page →

28,814

codetranstest-opea

1.0.0

2 of 5 See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/codetrans :1.0	e2436483b73d	pygments@2.18.0	2.20.0
opea/llm-tgi :1.0	0c25aab3f106	pygments@2.18.0	2.20.0

Open the chart page →

28,385

docsumtest-opea

1.0.0

2 of 5 See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/docsum :1.0	3eaa91849512	pygments@2.18.0	2.20.0
opea/llm-docsum-tgi :1.0	02f9e8fa5d71	pygments@2.18.0	2.20.0

Open the chart page →

28,858

embedding-usvctest-opea

1.0.0

1 of 1 See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/embedding-tei :1.0	5c9639de61c1	pygments@2.18.0	2.20.0

Open the chart page →

5,185

guardrails-usvctest-opea

1.0.0

1 of 1 See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/guardrails-tgi :1.0	262c6048aab8	pygments@2.18.0	2.20.0

Open the chart page →

5,221

llm-uservicetest-opea

1.0.0

1 of 1 See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/llm-tgi :1.0	0c25aab3f106	pygments@2.18.0	2.20.0

Open the chart page →

4,720

reranking-usvctest-opea

1.0.0

1 of 1 See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/reranking-tei :1.0	e48613afb191	pygments@2.18.0	2.20.0

Open the chart page →

4,985

retriever-usvctest-opea

1.0.0

1 of 1 See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/retriever-redis :1.0	eb746b263705	pygments@2.18.0	2.20.0

Open the chart page →

5,198

speecht5test-opea

1.0.0

1 of 1 See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/speecht5 :1.0	249afad3d268	pygments@2.18.0	2.20.0

Open the chart page →

9,616

ttstest-opea

1.0.0

1 of 1 See more

4,377

web-retrievertest-opea

1.0.0

1 of 1 See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
opea/web-retriever-chroma :1.0	fe08165d7770	pygments@2.18.0	2.20.0

Open the chart page →

5,350

tezos-nodetezos-node

1.0.0

1 of 4 See more

tezos-node tezos-node 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
oxheadalpha/tezos-k8s-utils :5.3.4	d9faed45bf1c	pygments@2.10.0	2.20.0

Open the chart page →

5,321

simple-prima-notavcnngr

0.5.3

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.2	52cb72a9e3da	pygments@2.19.1	2.20.0

Open the chart page →

4,768

devportalveecode-platform-next

0.1.21

1 of 1 See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
veecode/devportaldigest-pinned	c443520aebf7	pygments@2.19.2	2.20.0

Open the chart page →

1,787

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	pygments@2.19.2	2.20.0

Open the chart page →

7,628

supersetwbstack

0.1.0

1 of 1 See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
apache/superset :4.0.1	ab9467fd712c	pygments@2.15.0	2.20.0

Open the chart page →

7,085

zahori-serverzahori

1.0.1

1 of 2 See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-4539.

Container image	Digest	Package	Fixed in
flyway/flyway :9.14.1-alpine	80f12c80502b	pygments@2.14.0	2.20.0

Open the chart page →

5,846

Container images carrying it

185 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
fiware/biz-ecosystem-charging-backend :11.7.0	29456835bb2c	pygments@2.19.2	2.20.0	1
flanksource/batch-runner :v1.0.44	689687a7cf95	pygments@2.19.2	2.20.0	1
fluent/fluent-bit :4.0-debug	e76397ef3983	pygments@2.14.0+dfsg-1 pygments@2.14.0	no fix listed 2.20.0	1
flyway/flyway :9.15	45b5d7cdc75a	pygments@2.14.0	2.20.0	1
flyway/flyway :9.14.1-alpine	80f12c80502b	pygments@2.14.0	2.20.0	1
fossology/fossology :4.2.1	8bd1f22ba7bb	pygments@2.13.0	2.20.0	1
galaxy/galaxy-init :v18.01	0267bad550e6	pygments@2.2.0	2.20.0	1
gethue/hue :4.11.0	11b649636e68	pygments@2.14.0	2.20.0	1
gethue/hue :4.10.0	5702b2c37ff9	pygments@2.9.0	2.20.0	1
gethue/hue :latest	7d5c1b9f8a79	pygments@2.19.2	2.20.0	1
heartexlabs/label-studio :latest	aa461572e8f9	pygments@2.16.1	2.20.0	1
hjacobs/kube-web-view :23.8.0	431f1bf013d0	pygments@2.15.1	2.20.0	1
hjacobs/kube-web-view :20.10.0	b44a9cf81a2f	pygments@2.7.1	2.20.0	1
homeassistant/home-assistant :2023.10.3	021e2afc6e57	pygments@2.16.1	2.20.0	1
homeassistant/home-assistant :2023.12.4	8d000332b09b	pygments@2.17.2	2.20.0	1
improwised/erpnext-worker :v13.4.1	97280b55cbd4	pygments@2.9.0	2.20.0	1
jmferrer/azure-devops-agent :latest	030f68ec6998	pygments@2.4.2	2.20.0	1
jonasal/devpi-server :6.17.0-alpine	ec1eee99a18d	pygments@2.19.2	2.20.0	1
jupyterhub/k8s-singleuser-sample :3.0.1-0.dev.git.6287.hbfb05cd6	8e4778efec8e	pygments@2.16.1	2.20.0	1
jupyterhub/k8s-singleuser-sample :0.11.1	e3e6f3051df8	pygments@2.7.1	2.20.0	1
knspar/phronetis :0.1.46	09499d2dc91a	pygments@2.19.2	2.20.0	1
knspar/phronetis-operator :0.1.6	0c4f0543ee58	pygments@2.19.1	2.20.0	1
kobotoolbox/kpi :2.022.24d	bcacc01bccd4	pygments@2.11.2	2.20.0	1
kyso/kyso-nbdime :latest	4aa9d38ee81d	pygments@2.13.0	2.20.0	1
langgenius/dify-api :1.0.0	066035f93856	pygments@2.19.1	2.20.0	1
langgenius/dify-api :0.6.11	fca918260dd6	pygments@2.18.0	2.20.0	1
linuxserver/calibre-web :0.6.24	241009026e6f	pygments@2.19.2	2.20.0	1
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pygments@2.19.2	2.20.0	1
lmacka/snappass :2.1.2	93f5c048b7d4	pygments@2.19.2	2.20.0	1
localstack/localstack :3.1	9d278167f2b7	pygments@2.17.2	2.20.0	1
lsstsqre/sciplat-hub :latest	5e0ade6bed1c	pygments@2.8.1	2.20.0	1
makersquad/harp-proxy :0.8.1	a40dd258c527	pygments@2.14.0+dfsg-1 pygments@2.14.0	no fix listed 2.20.0	1
mediagis/nominatim :3.7	c15e941485ef	pygments@2.3.1+dfsg-1ubuntu2.2 pygments@2.3.1	no fix listed 2.20.0	1
mediagis/nominatim :4.2	d0eae7b51374	pygments@2.11.2+dfsg-2 pygments@2.11.2	no fix listed 2.20.0	1
mintproject/model-catalog-fastapi :7dd88dc5bf1fe6a6d4703ea0a077afee45cb2561	02260d20a21f	pygments@2.19.1	2.20.0	1
mvitale1989/docker-taiga :20191031-4.2.14	1504ccda06df	pygments@2.2.0	2.20.0	1
ncsapolyglot/converters-ebook-convert :latest	438d82cdbdb5	pygments@2.2.0	2.20.0	1
netboxcommunity/netbox :v3.2.8	3d652dca5351	pygments@2.12.0	2.20.0	1
netboxcommunity/netbox :v3.7.8-2.8.0	9bf83b350a89	pygments@2.18.0	2.20.0	1
opea/asr :1.0	25dd26d9cd09	pygments@2.18.0	2.20.0	1
opea/chatqna :1.0	38c51b791efa	pygments@2.18.0	2.20.0	1
opea/codegen :1.0	58f91683892d	pygments@2.18.0	2.20.0	1
opea/codetrans :1.0	e2436483b73d	pygments@2.18.0	2.20.0	1
opea/docsum :1.0	3eaa91849512	pygments@2.18.0	2.20.0	1
opea/guardrails-tgi :1.0	262c6048aab8	pygments@2.18.0	2.20.0	1
opea/guardrails-tgi :latest	f68bec6a1271	pygments@2.19.1	2.20.0	1
opea/llm-docsum-tgi :1.0	02f9e8fa5d71	pygments@2.18.0	2.20.0	1
opea/speecht5 :1.0	249afad3d268	pygments@2.18.0	2.20.0	1
opea/tts :1.0	257ae94709e9	pygments@2.18.0	2.20.0	1
opea/web-retriever-chroma :1.0	fe08165d7770	pygments@2.18.0	2.20.0	1