Vulnerability DatabaseCVE-2026-18503
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-18503
Published:August 10, 2026
Updated:September 01, 2026
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
Affected Packages
https://github.com/python/cpython.git (GITHUB):
Affected version(s) >=v3.14.0 <v3.14.7
Fix Suggestion:
Update to version v3.14.7
https://github.com/python/cpython.git (GITHUB):
Affected version(s) >=v0.9.8 <v3.13.15
Fix Suggestion:
Update to version v3.13.15
Related Resources (12)
https://nvd.nist.gov/vuln/detail/CVE-2026-18503
https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82
https://github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693b
https://github.com/python/cpython/issues/98820
https://github.com/python/cpython/commit/fd78b565d7c326f96ae903ab945b47f35d829cf4
https://github.com/python/cpython/pull/153694
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18503.json
https://github.com/python/cpython
https://github.com/python/cpython/commit/b09a67a20c464f8288c9f9a6b9c7082a74560024
https://github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946a
https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/
https://github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9
Do you need more information?
Contact Us
CVSS v4
Base Score:
2.4
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
PASSIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
2.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
LOW
Weakness Type (CWE)
Inefficient CPU Computation
CWE-1176
EPSS
Base Score:
0.12