CVE-2026-18503
Received Received - Intake

Regular Expression Denial of Service in Python csv.Sniffer

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Python Software Foundation

Description
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-18503
EUVD
EUVD-2026-55630

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1176 The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves attacker-controlled CSV files that cause excessive CPU usage during regular expression processing. When applications use the csv.Sniffer.sniff() function with unbounded input, the system performs super-linear work during dialect sniffing, leading to potential denial-of-service conditions.

Detection Guidance

This vulnerability can be detected by monitoring CPU usage spikes when processing CSV files. Check for applications using Python's csv.Sniffer.sniff() with unbounded input. Use system monitoring tools like top, htop, or ps to observe CPU consumption during CSV parsing tasks.

Impact Analysis

An attacker could exploit this by providing malicious CSV files to consume significant CPU resources, potentially slowing down or crashing the affected application. This may lead to degraded performance or service unavailability for legitimate users.

Mitigation Strategies

Immediately update Python to the latest version where this issue is patched. Avoid passing unbounded CSV input to csv.Sniffer.sniff(). Implement input size limits and validate CSV files before processing. Monitor affected applications for unusual CPU usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18503. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart