CVE Catalog
CVE-2026-18503
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk0.12%
2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in Python's csv.Sniffer where attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing, consuming significant CPU.
Risk Assessment
An attacker can cause server or application overload, leading to denial of service (DoS).
Recommendation
Limit the size of input data passed to csv.Sniffer.sniff() or apply timeouts.
Original NVD description (English source)
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().