Remote Code Execution Vulnerability in Python's CSV Module
CVE-2026-18503

2.4LOW

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
10 August 2026

What is CVE-2026-18503?

A vulnerability exists in Python's CSV module where attacker-controlled CSV samples can induce super-linear regular-expression processing during dialect sniffing. This can lead to significant CPU consumption when applications process unbounded input using the csv.Sniffer.sniff() method. If unvalidated CSV data is supplied by a malicious actor, it can exhaust system resources, affecting application performance and availability.

Affected Version(s)

CPython 0 < 3.10.21

CPython 3.11.0 < 3.11.16

CPython 3.12.0 < 3.12.14

References

https://mail.python.org/archives/list/security-announce@p...
vendor-advisory
https://github.com/python/cpython/pull/153694
patch
https://github.com/python/cpython/issues/98820
issue-tracking

CVSS V4

Score:
2.4
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Serhiy Storchaka (https://github.com/serhiy-storchaka)
Jack Desert (https://github.com/jackdesert)
Sean Gilligan (https://github.com/sg3-141-592)
Seth Larson (https://github.com/sethmlarson)
.