CVE-2026-18503
lowpriority · track · 0EPSS 0.001 · 2 %ileEUUSEPSS · scored 2026-10-22
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (21)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- BIT-libpython-2026-18503Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()2026-08-17vendor · osvUS
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
- BIT-python-2026-18503Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()2026-08-17vendor · osvUS
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
- BIT-python-min-2026-18503Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()2026-08-17vendor · osvUS
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
- PSF-2026-352026-08-10vendor · osvUS
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
also known as (7)
Other names and identifiers for this entity.
- CNNVD-2026-68996934cnnvd
- EUVD-2026-55630enisa_euvd
- GHSA-2345-wr3r-cxf2enisa_euvd
- BIT-libpython-2026-18503osv
- BIT-python-2026-18503osv
- BIT-python-min-2026-18503osv
- PSF-2026-35osv
sources
Which sources assert this record, and when.
references (25)
External citations — patches, advisories, analysis.
- https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82cnnvd
- https://github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9cnnvd
- https://github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946acnnvd
- https://github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693bcnnvd
- https://github.com/python/cpython/issues/98820cnnvd
- https://github.com/python/cpython/pull/153694cnnvd
- https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/cnnvd
- https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan