# CVE-2026-18503

## Summary

- **CVE ID:** CVE-2026-18503
- **Severity:** LOW
- **CVSS Score:** 2.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
- **CWE:** CWE-1176
- **Published:** Aug 10, 2026
- **Last Modified:** Aug 13, 2026

## Description

Attacker-controlled CSV samples can trigger super-linear 
regular-expression work during dialect sniffing and consume significant 
CPU when applications pass unbounded input to csv.Sniffer.sniff().

## Affected Products

- Python Software Foundation — CPython (0)
- Python Software Foundation — CPython (3.14.0)
- Python Software Foundation — CPython (3.15.0a1)
- Python Software Foundation — CPython (3.11.0)
- Python Software Foundation — CPython (3.12.0)
- Python Software Foundation — CPython (3.13.0)

## References

- [CNA](https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/)
- [CNA](https://github.com/python/cpython/pull/153694)
- [CNA](https://github.com/python/cpython/issues/98820)
- [CNA](https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82)
- [CNA](https://github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9)
- [CNA](https://github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946a)
- [CNA](https://github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693b)
- [CNA](https://github.com/python/cpython/commit/b09a67a20c464f8288c9f9a6b9c7082a74560024)
- [CNA](https://github.com/python/cpython/commit/fd78b565d7c326f96ae903ab945b47f35d829cf4)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.12%
- **EPSS Percentile:** 2.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._