CVE-2026-18503

Published: Aug 10, 2026Modified: Aug 18, 2026

2.4

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

Related CWEs

Inefficient CPU Computation

The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.

References (9)

https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82

Source: cna@python.org

https://github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9

Source: cna@python.org

https://github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946a

Source: cna@python.org

https://github.com/python/cpython/commit/b09a67a20c464f8288c9f9a6b9c7082a74560024

Source: cna@python.org

https://github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693b

Source: cna@python.org

https://github.com/python/cpython/commit/fd78b565d7c326f96ae903ab945b47f35d829cf4

Source: cna@python.org

https://github.com/python/cpython/issues/98820

Source: cna@python.org

https://github.com/python/cpython/pull/153694

Source: cna@python.org

https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/

Source: cna@python.org

Timeline

No history available yet.