Regex DoS in CPython csv.Sniffer 3.13.15-3.14.6
CVE-2026-18503 Published on August 10, 2026
Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
Attacker-controlled CSV samples can trigger super-linear
regular-expression work during dialect sniffing and consume significant
CPU when applications pass unbounded input to csv.Sniffer.sniff().
Vulnerability Analysis
CVE-2026-18503 can be exploited with local system access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Inefficient CPU Computation
The program performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.
Products Associated with CVE-2026-18503
Want to know whenever a new CVE is published for Cpython? stack.watch will email you.
Affected Versions
Python Software Foundation CPython:- Before 3.13.15 is affected.
- Version 3.14.0 and below 3.14.7 is affected.
- Version 3.15.0a1 and below 3.15.0rc1 is affected.