CVE-2026-18503
Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
| CWE | CWE-1176 |
| Vendor | python software foundation |
| Product | cpython |
| Published | Aug 10, 2026 |
| Last Updated | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.13.15 3.14.0 < 3.14.7 3.15.0a1 < 3.15.0rc1
References
mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/ github.com: https://github.com/python/cpython/pull/153694 github.com: https://github.com/python/cpython/issues/98820 github.com: https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82 github.com: https://github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9 github.com: https://github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946a github.com: https://github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693b
Credits
Serhiy Storchaka (https://github.com/serhiy-storchaka) 🔍 Jack Desert (https://github.com/jackdesert) 🔍 Sean Gilligan (https://github.com/sg3-141-592) Seth Larson (https://github.com/sethmlarson)