CVE-2022-40896

Pygments vulnerable to ReDoS

5.5 MediumFix available

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.52%Up 0.5 points since Jul 20, 2023

What each source reports

NVD Score used 5.5

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Record: CVE-2022-40896
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-434
Updated: 2026-11-02

CVE List No score

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Record: CVE-2022-40896
Updated: 2026-11-02

EUVDEUVD-2023-0215 No score

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Record: EUVD-2023-0215
Updated: 2026-11-03

GitHub AdvisoriesGHSA-mrwq-x4v8-fh7p 6.8

Pygments vulnerable to ReDoS

A ReDoS issue was discovered in pygments/lexers/smithy.py in Pygments until 2.15.0 via SmithyLexer.

Record: GHSA-mrwq-x4v8-fh7p
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-434
Updated: 2026-11-02

OSVAZL-27502 5.5

CVE-2022-40896 affecting package python-pygments for versions less than 2.4.2-1

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Record: AZL-27502
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-35139 5.5

CVE-2022-40896 affecting package python-pygments for versions less than 2.4.2-1

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Record: AZL-35139
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-05

Show 13 moreShow less

OSVDEBIAN-CVE-2022-40896 5.5

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Record: DEBIAN-CVE-2022-40896
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVGHSA-mrwq-x4v8-fh7p 6.8

Pygments vulnerable to ReDoS

A ReDoS issue was discovered in pygments/lexers/smithy.py in Pygments until 2.15.0 via SmithyLexer.

Record: GHSA-mrwq-x4v8-fh7p
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-434
Updated: 2026-11-02

OSVOESA-2023-1477 5.5

python-pygments security update

Pygments is a generic syntax highlighter suitable for use in code hosting, forums, wikis or other applications that need to prettify source code.

Security Fix(es):

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.(CVE-2022-40896)

Record: OESA-2023-1477
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2023-1478 5.5

python-pygments security update

Pygments is a generic syntax highlighter suitable for use in code hosting, forums, wikis or other applications that need to prettify source code.

Security Fix(es):

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.(CVE-2022-40896)

Record: OESA-2023-1478
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2023-1479 5.5

python-pygments security update

Pygments is a generic syntax highlighter suitable for use in code hosting, forums, wikis or other applications that need to prettify source code.

Security Fix(es):

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.(CVE-2022-40896)

Record: OESA-2023-1479
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:1057 8.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Record: RHSA-2024:1057
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2024:2010 7.6

Red Hat Security Advisory: Satellite 6.15.0 release

Record: RHSA-2024:2010
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Updated: 2026-11-02

OSVROOT-APP-PYPI-CVE-2022-40896 5.5

CVE-2022-40896 in rootio-Pygments - Patched by Root

Root has patched CVE-2022-40896 in the rootio-Pygments package for Root:PyPI. Multiple fixed versions available.

Record: ROOT-APP-PYPI-CVE-2022-40896
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-40896 5.5

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Record: UBUNTU-CVE-2022-40896
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV No score

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Record: CVE-2022-40896
Updated: 2026-11-02

OSVMGASA-2024-0107 No score

Updated python-pygments packages fix security vulnerability

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Record: MGASA-2024-0107
Updated: 2026-11-02

OSVPYSEC-2023-117 No score

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

Record: PYSEC-2023-117
Updated: 2026-11-02

OSVUSN-7128-1 No score

pygments vulnerability

Sebastian Chnelik discovered that Pygments had an inefficient regex query for analyzing certain inputs. An attacker could possibly use this issue to cause a denial of service.

Record: USN-7128-1
Updated: 2026-11-02

Affected products

pygments

Affected packages

Affected packages
Package	Affected	Fixed
`pygments` PyPI	before 2.15.0	2.15.0
`python-pygments` Azure Linux:2	before 2.4.2-1	2.4.2-1
`python-pygments` Azure Linux:3	before 2.4.2-1	2.4.2-1
`pygments` Debian:12	All versions, plus listed versions 2.14.0+dfsg-12.15.0+dfsg-12.15.1+dfsg-12.17.2+dfsg-12.18.0+dfsg-1 Show 4 moreShow less 2.18.0+dfsg-22.19.2+dfsg-12.20.0+dfsg-12.20.0+dfsg-2	None known
`pygments` Debian:13	before 2.15.1+dfsg-1	2.15.1+dfsg-1
`pygments` Debian:14	before 2.15.1+dfsg-1	2.15.1+dfsg-1
`pygments` PyPI	before 2.15.0, plus listed versions 0.100.110.11.10.50.5.1 Show 45 moreShow less 0.60.70.7.10.80.8.10.91.01.11.1.11.21.2.11.2.21.31.3.11.41.51.61.6rc12.02.0.12.0.22.0rc12.12.1.12.1.22.1.32.10.02.11.02.11.12.11.22.12.02.13.02.14.02.2.02.3.02.3.12.4.02.4.12.4.22.5.12.5.22.6.02.6.12.7.02.7.1	2.15.0
`python-pygments` Mageia:9	before 2.15.1-1.mga9	2.15.1-1.mga9
`python-pygments` openEuler:22.03-LTS	before 2.10.0-4.oe2203	2.10.0-4.oe2203
`python-pygments` openEuler:22.03-LTS-SP1	before 2.10.0-4.oe2203sp1	2.10.0-4.oe2203sp1

Show 128 moreShow less

Affected packages
Package	Affected	Fixed
`python-pygments` openEuler:22.03-LTS-SP2	before 2.10.0-4.oe2203sp2	2.10.0-4.oe2203sp2
`pygments` PyPI	before 2.15.1, plus listed versions 0.100.110.11.10.50.5.1 Show 45 moreShow less 0.60.70.7.10.80.8.10.91.01.11.1.11.21.2.11.2.21.31.3.11.41.51.61.6rc12.02.0.12.0.22.0rc12.12.1.12.1.22.1.32.10.02.11.02.11.12.11.22.12.02.13.02.14.02.15.02.2.02.3.02.3.12.4.02.4.12.4.22.5.12.5.22.6.02.6.12.7.0	2.15.1
`python39-pygments` Red Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 9 CVEs	before 0:2.17.2-1.el8ap	0:2.17.2-1.el8ap
`python3x-pygments` Red Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 9 CVEs	before 0:2.17.2-1.el8ap	0:2.17.2-1.el8ap
`python39-pygments` Red Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 9 CVEs	before 0:2.17.2-1.el8ap	0:2.17.2-1.el8ap
`python3x-pygments` Red Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 9 CVEs	before 0:2.17.2-1.el8ap	0:2.17.2-1.el8ap
`python39-pygments` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:2.17.2-1.el8ap	0:2.17.2-1.el8ap
`python3x-pygments` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:2.17.2-1.el8ap	0:2.17.2-1.el8ap
`python-pygments` Red Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 9 CVEs	before 0:2.17.2-1.el9ap	0:2.17.2-1.el9ap
`python3-pygments` Red Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 9 CVEs	before 0:2.17.2-1.el9ap	0:2.17.2-1.el9ap
`python-pygments` Red Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 9 CVEs	before 0:2.17.2-1.el9ap	0:2.17.2-1.el9ap
`python3-pygments` Red Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 9 CVEs	before 0:2.17.2-1.el9ap	0:2.17.2-1.el9ap
`python-pygments` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:2.17.2-1.el9ap	0:2.17.2-1.el9ap
`python3-pygments` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:2.17.2-1.el9ap	0:2.17.2-1.el9ap
`python39-pillow` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:10.0.1-1.el8ap	0:10.0.1-1.el8ap
`python39-pillow-debuginfo` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:10.0.1-1.el8ap	0:10.0.1-1.el8ap
`python3x-pillow` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:10.0.1-1.el8ap	0:10.0.1-1.el8ap
`python3x-pillow-debugsource` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:10.0.1-1.el8ap	0:10.0.1-1.el8ap
`python-pillow` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:10.0.1-1.el9ap	0:10.0.1-1.el9ap
`python-pillow-debugsource` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:10.0.1-1.el9ap	0:10.0.1-1.el9ap
`python3-pillow` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:10.0.1-1.el9ap	0:10.0.1-1.el9ap
`python3-pillow-debuginfo` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:10.0.1-1.el9ap	0:10.0.1-1.el9ap
`python39-aiohttp` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:3.9.1-1.el8ap	0:3.9.1-1.el8ap
`python39-aiohttp-debuginfo` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:3.9.1-1.el8ap	0:3.9.1-1.el8ap
`python3x-aiohttp` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:3.9.1-1.el8ap	0:3.9.1-1.el8ap
`python3x-aiohttp-debugsource` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:3.9.1-1.el8ap	0:3.9.1-1.el8ap
`python-aiohttp` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:3.9.1-1.el9ap	0:3.9.1-1.el9ap
`python-aiohttp-debugsource` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:3.9.1-1.el9ap	0:3.9.1-1.el9ap
`python3-aiohttp` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:3.9.1-1.el9ap	0:3.9.1-1.el9ap
`python3-aiohttp-debuginfo` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:3.9.1-1.el9ap	0:3.9.1-1.el9ap
`python39-pycryptodomex` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:3.20.0-1.el8ap	0:3.20.0-1.el8ap
`python39-pycryptodomex-debuginfo` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:3.20.0-1.el8ap	0:3.20.0-1.el8ap
`python3x-pycryptodomex` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:3.20.0-1.el8ap	0:3.20.0-1.el8ap
`python3x-pycryptodomex-debugsource` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:3.20.0-1.el8ap	0:3.20.0-1.el8ap
`python-pycryptodomex` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:3.20.0-1.el9ap	0:3.20.0-1.el9ap
`python-pycryptodomex-debugsource` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:3.20.0-1.el9ap	0:3.20.0-1.el9ap
`python3-pycryptodomex` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:3.20.0-1.el9ap	0:3.20.0-1.el9ap
`python3-pycryptodomex-debuginfo` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:3.20.0-1.el9ap	0:3.20.0-1.el9ap
`ansible-automation-platform-installer` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:2.4-6.el8ap	0:2.4-6.el8ap
`ansible-rulebook` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:1.0.5-1.el8ap	0:1.0.5-1.el8ap
`automation-eda-controller` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:1.0.5-1.el8ap	0:1.0.5-1.el8ap
`automation-eda-controller-server` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:1.0.5-1.el8ap	0:1.0.5-1.el8ap
`automation-eda-controller-ui` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:1.0.5-1.el8ap	0:1.0.5-1.el8ap
`ansible-automation-platform-installer` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:2.4-6.el9ap	0:2.4-6.el9ap
`ansible-rulebook` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:1.0.5-1.el9ap	0:1.0.5-1.el9ap
`automation-eda-controller` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:1.0.5-1.el9ap	0:1.0.5-1.el9ap
`automation-eda-controller-server` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:1.0.5-1.el9ap	0:1.0.5-1.el9ap
`automation-eda-controller-ui` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:1.0.5-1.el9ap	0:1.0.5-1.el9ap
`python39-jinja2` Red Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 9 CVEs	before 0:3.1.3-1.el8ap	0:3.1.3-1.el8ap
`python3x-jinja2` Red Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 9 CVEs	before 0:3.1.3-1.el8ap	0:3.1.3-1.el8ap
`python39-jinja2` Red Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 9 CVEs	before 0:3.1.3-1.el8ap	0:3.1.3-1.el8ap
`python3x-jinja2` Red Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 9 CVEs	before 0:3.1.3-1.el8ap	0:3.1.3-1.el8ap
`python39-jinja2` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:3.1.3-1.el8ap	0:3.1.3-1.el8ap
`python3x-jinja2` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:3.1.3-1.el8ap	0:3.1.3-1.el8ap
`python-jinja2` Red Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 9 CVEs	before 0:3.1.3-1.el9ap	0:3.1.3-1.el9ap
`python3-jinja2` Red Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 9 CVEs	before 0:3.1.3-1.el9ap	0:3.1.3-1.el9ap
`python-jinja2` Red Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 9 CVEs	before 0:3.1.3-1.el9ap	0:3.1.3-1.el9ap
`python3-jinja2` Red Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 9 CVEs	before 0:3.1.3-1.el9ap	0:3.1.3-1.el9ap
`python-jinja2` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:3.1.3-1.el9ap	0:3.1.3-1.el9ap
`python3-jinja2` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:3.1.3-1.el9ap	0:3.1.3-1.el9ap
`python39-django` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:4.2.10-1.el8ap	0:4.2.10-1.el8ap
`python3x-django` Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 9 CVEs	before 0:4.2.10-1.el8ap	0:4.2.10-1.el8ap
`python-django` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:4.2.10-1.el9ap	0:4.2.10-1.el9ap
`python3-django` Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 9 CVEs	before 0:4.2.10-1.el9ap	0:4.2.10-1.el9ap
`python-pygments` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`python3.11-pygments` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`python-pygments` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`python3.11-pygments` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`foreman` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-debug` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman` Red Hat:satellite_utils:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-cli` Red Hat:satellite_utils:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-cli` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-debug` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-dynflow-sidekiq` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-ec2` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-journald` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-libvirt` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-openstack` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-ovirt` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-pcp` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-postgresql` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-redis` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-service` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-telemetry` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-vmware` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`python-galaxy-importer` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`python3.11-galaxy-importer` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`python-galaxy-importer` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`python3.11-galaxy-importer` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`puppetserver` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:7.14.0-1.el8sat	0:7.14.0-1.el8sat
`puppetserver` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:7.14.0-1.el8sat	0:7.14.0-1.el8sat
`python-aiohttp` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python-aiohttp-debugsource` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp-debuginfo` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python-aiohttp` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python-aiohttp-debugsource` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp-debuginfo` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`rubygem-activesupport` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:6.1.7.6-1.el8sat	0:6.1.7.6-1.el8sat
`rubygem-activesupport` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.1.7.6-1.el8sat	0:6.1.7.6-1.el8sat
`python-django` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python3.11-django` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python-django` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python3.11-django` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python-pycryptodomex` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python-pycryptodomex-debugsource` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex-debuginfo` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python-pycryptodomex` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python-pycryptodomex-debugsource` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex-debuginfo` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`rubygem-puma` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.4.2-1.el8sat	0:6.4.2-1.el8sat
`rubygem-puma-debuginfo` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.4.2-1.el8sat	0:6.4.2-1.el8sat
`rubygem-puma-debugsource` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.4.2-1.el8sat	0:6.4.2-1.el8sat
`rubygem-audited` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:5.4.2-1.el8sat	0:5.4.2-1.el8sat
`python-jinja2` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`python3.11-jinja2` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`python-jinja2` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`python3.11-jinja2` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`rootio-Pygments` Root:PyPI	before 2.12.0+root.io.1	2.12.0+root.io.12.12.0+root.io.22.12.0+root.io.3
`Pygments` Root:PyPI	before 2.12.0+aikido.2	2.12.0+aikido.22.12.0+aikido.3
`pygments` Ubuntu:18.04:LTS	All versions, plus listed versions 2.2.0+dfsg-12.2.0+dfsg-1ubuntu0.12.2.0+dfsg-1ubuntu0.2	None known
`pygments` Ubuntu:20.04:LTS	All versions, plus listed versions 2.3.1+dfsg-1ubuntu12.3.1+dfsg-1ubuntu22.3.1+dfsg-1ubuntu2.12.3.1+dfsg-1ubuntu2.2	None known
`pygments` Ubuntu:22.04:LTS	before 2.11.2+dfsg-2ubuntu0.1, plus listed versions 2.7.1+dfsg-2.12.10.0+dfsg-12.11.2+dfsg-2	2.11.2+dfsg-2ubuntu0.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-40896 is a medium vulnerability (CVSS 5.5) in Pygments, published July 19, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in pygments 2.15.0.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 13 versions and 167 references. The JSON record has them.