CVE-2026-18503: Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
Other sources
Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.14-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18503?
CVE-2026-18503 is considered a moderate risk with a CVSS score of 4.9.
How do I fix CVE-2026-18503?
To mitigate CVE-2026-18503, validate and limit the size of input passed to csv.Sniffer.sniff() before processing.
What software is affected by CVE-2026-18503?
CVE-2026-18503 affects the Python csv.Sniffer module.
What is the potential impact of CVE-2026-18503?
CVE-2026-18503 can lead to significant CPU consumption, potentially causing denial of service for applications.
When was CVE-2026-18503 published?
CVE-2026-18503 was published on August 10, 2026.