Cloudanix VulnDB

CVE-2026-18503

None

CVSS

—

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in Python's CSV handling lets specially crafted data files make programs use far too much processing power, potentially slowing or stopping services that read untrusted spreadsheets or data files.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unbounded attacker-controlled CSV input to csv.Sniffer.sniff() triggers super-linear regex evaluation during dialect detection, resulting in excessive CPU consumption and potential denial of service.

Why it matters to the business

Applications processing untrusted CSV data may experience high CPU load leading to degraded performance or outages; widespread Python deployments on Red Hat increase exposure across many environments with remediation available after 77 days.

How an attack unfolds

An attacker crafts a malicious CSV sample designed to cause catastrophic backtracking in the dialect-sniffing regex, then supplies it to any application that calls csv.Sniffer.sniff() on untrusted or unbounded input, causing sustained high CPU usage on the target process.

How to fix it

Upgrade affected Red Hat Python packages to the fixed versions: python3-10-main to 3.10.21-1.hum1, python3-11-main to 3.11.16-1.hum1, python3-12-main to 3.12.14-1.hum1, python3-13-main to 3.13.15-1.hum1, or python3-14-main to 3.14.7-1.hum1 (all via RHSA-2026:54534). Enforce input size limits and avoid calling sniff() on untrusted data until patched.

How to confirm the fix worked

Verify package versions match the fixed releases listed in RHSA-2026:54534, re-test affected code paths with previously triggering CSV samples to confirm CPU usage remains bounded, and review application input handling for unbounded csv.Sniffer usage.

Typical attack path

  1. Identify an application endpoint or function accepting CSV data and passing it directly to csv.Sniffer.sniff() without size or content validation.
  2. Craft a CSV payload that triggers super-linear regex work during dialect sniffing.
  3. Submit the payload via file upload, API request, or other input channel.
  4. Observe sustained CPU consumption on the affected Python process leading to resource exhaustion.

How to detect it

Review system and application logs for Python processes exhibiting sustained high CPU while parsing CSV input; correlate with web server or application access logs showing CSV uploads or API calls around the time of resource spikes.

What your security team should do

  • Prioritize patching all listed Red Hat Python packages within the next maintenance window given 77 days of public exposure.
  • Audit codebases for direct or indirect use of csv.Sniffer.sniff() on untrusted input and add strict size/content validation.
  • Monitor for unusual CPU spikes in Python processes handling CSV data until patches are deployed.

The record

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities