Vulnerability in Python Software Foundation Cpython
CVE-2026-18503
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
Published · last modified .
EPSS exploit prediction
EPSS: 0.001 (2.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 2.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000
Affected products
- Python Software Foundation Cpython — versions 3.14.0, 0, 3.13.0
Weakness classification (CWE)
References
- github.com/python/cpython/issues/98820 (issue-tracking)
- github.com/python/cpython/pull/153694 (patch)
- mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHR… (vendor-advisory)
- github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82 (patch)
- github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9 (patch)
- github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946a (patch)
- github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693b (patch)
- github.com/python/cpython/commit/b09a67a20c464f8288c9f9a6b9c7082a74560024 (patch)
- github.com/python/cpython/commit/fd78b565d7c326f96ae903ab945b47f35d829cf4 (patch)