CVE-2026-18503

A flaw was found in the csv.Sniffer.sniff() function within Python. An attacker can exploit this by providing specially crafted CSV samples, which can trigger super-linear regular-expression processing during dialect sniffing. This excessive processing consumes significant CPU resources, potentially leading to a Denial of Service (DoS) for applications that process unbounded input using this function.

Red Hat has evaluated this issue and determined it has a Low security impact. The csv.Sniffer.sniff() function in Python's standard library is vulnerable to excessive CPU consumption when processing specially crafted CSV input, due to quadratic time complexity in the dialect sniffing regex. Most applications are not affected as they use csv.reader() or csv.DictReader() directly without invoking the sniffing functionality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not pass untrusted or unbounded CSV input to csv.Sniffer.sniff(). If dialect detection is needed, limit the size of the sample passed to sniff() or use a known dialect directly with csv.reader().