CVE-2026-18503

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

Scoring

Severity

LOW

CVSS base score

2.4

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS probability

0.12%

CWE

CWE-1176

Published

2026-08-10

Last modified

2026-08-13

Affected products

• Python Software Foundation CPython
• Python Software Foundation CPython
• Python Software Foundation CPython
• Python Software Foundation CPython
• Python Software Foundation CPython
• Python Software Foundation CPython

Weakness type

• CWE-1176

Related vulnerabilities

• CVE-2024-23323 — Excessive CPU usage when URI template matcher is configured using regex in Envoy

Markdown version · Browse all CVEs