PSF-2026-35: Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Published Aug 10, 2026

Updated

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

Affected Software

1 affected component

Python Software Foundation Python

Event History

Aug 10, 2026

CVE Published

via OSV·01:45 PM

Data Sourced

via OSV·01:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions make an application vulnerable to CPU exhaustion?

The application must pass attacker-controlled, unbounded CSV sample data to csv.Sniffer.sniff(). Crafted input can cause super-linear regular-expression processing and significant CPU consumption during dialect detection.

What access does an attacker need?

The vector is local and the attacker needs low privileges. User interaction is required, according to the supplied severity vector.

What can be done if patching is not immediately possible?

Avoid passing unbounded input to csv.Sniffer.sniff(). Limit the size of CSV samples accepted for dialect sniffing, particularly when the sample can be controlled by an attacker.

PSF-2026-35: Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Affected Software

Event History

Frequently Asked Questions

What conditions make an application vulnerable to CPU exhaustion?

What access does an attacker need?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What conditions make an application vulnerable to CPU exhaustion?

What access does an attacker need?

What can be done if patching is not immediately possible?