A regular expression in Pygments’ AdlLexer can be engineered to consume excessive processing time, causing the application that processes the input to hang or crash. The vulnerability results in uncontrolled resource consumption, which degrades or halts service availability. It does not lead to data disclosure, tampering, or privilege escalation.

Pygments versions up to and including 2.19.2 are affected. The library is an open‑source Python package that can be imported by any project. Any environment that utilizes the AdlLexer in its tokenization process is at risk, regardless of vendor distribution.

The CVSS score of 4.8 indicates moderate severity, and no EPSS score is available. The issue is not listed in the CISA KEV catalog. Exploitation requires local access to an application that imports Pygments, so the attack vector is local. The public exploit demonstrates that a malicious input can trigger the denial‑of‑service condition, but it does not compromise confidentiality or integrity.