CVE-2026-18503
ADVISORY - nistSummary
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
EPSS Score: 0.00119 (0.021)
Common Weakness Enumeration (CWE)
ADVISORY - nist
Inefficient CPU Computation
Docker
CREATED
UPDATED
ADVISORY ID
CVE-2026-18503
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| python | dhi | - | - | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| alpine/python-3.10 | apk | alpine | 3.23 | <3.10.21 | 3.10.21 |
| alpine/python-3.10 | apk | alpine | 3.23 | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| alpine/python-3.10 | apk | alpine | 3.23 | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| alpine/python-3.10 | apk | alpine | 3.23 | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| alpine/python-3.10 | apk | alpine | 3.23 | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| alpine/python-3.10 | apk | alpine | 3.23 | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
| alpine/python-3.11 | apk | alpine | 3.23 | <3.10.21 | 3.10.21 |
| alpine/python-3.11 | apk | alpine | 3.23 | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| alpine/python-3.11 | apk | alpine | 3.23 | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| alpine/python-3.11 | apk | alpine | 3.23 | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| alpine/python-3.11 | apk | alpine | 3.23 | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| alpine/python-3.11 | apk | alpine | 3.23 | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
| alpine/python-3.12 | apk | alpine | 3.23 | <3.10.21 | 3.10.21 |
| alpine/python-3.12 | apk | alpine | 3.23 | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| alpine/python-3.12 | apk | alpine | 3.23 | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| alpine/python-3.12 | apk | alpine | 3.23 | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| alpine/python-3.12 | apk | alpine | 3.23 | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| alpine/python-3.12 | apk | alpine | 3.23 | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
| alpine/python-3.13 | apk | alpine | 3.23 | <3.10.21 | 3.10.21 |
| alpine/python-3.13 | apk | alpine | 3.23 | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| alpine/python-3.13 | apk | alpine | 3.23 | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| alpine/python-3.13 | apk | alpine | 3.23 | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| alpine/python-3.13 | apk | alpine | 3.23 | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| alpine/python-3.13 | apk | alpine | 3.23 | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
| alpine/python-3.14 | apk | alpine | 3.23 | <3.10.21 | 3.10.21 |
| alpine/python-3.14 | apk | alpine | 3.23 | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| alpine/python-3.14 | apk | alpine | 3.23 | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| alpine/python-3.14 | apk | alpine | 3.23 | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| alpine/python-3.14 | apk | alpine | 3.23 | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| alpine/python-3.14 | apk | alpine | 3.23 | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
| debian/python-3.10 | deb | debian | 13 | <3.10.21 | 3.10.21 |
| debian/python-3.10 | deb | debian | 13 | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| debian/python-3.10 | deb | debian | 13 | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| debian/python-3.10 | deb | debian | 13 | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| debian/python-3.10 | deb | debian | 13 | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| debian/python-3.10 | deb | debian | 13 | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
| debian/python-3.11 | deb | debian | 13 | <3.10.21 | 3.10.21 |
| debian/python-3.11 | deb | debian | 13 | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| debian/python-3.11 | deb | debian | 13 | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| debian/python-3.11 | deb | debian | 13 | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| debian/python-3.11 | deb | debian | 13 | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| debian/python-3.11 | deb | debian | 13 | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
| debian/python-3.12 | deb | debian | 13 | <3.10.21 | 3.10.21 |
| debian/python-3.12 | deb | debian | 13 | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| debian/python-3.12 | deb | debian | 13 | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| debian/python-3.12 | deb | debian | 13 | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| debian/python-3.12 | deb | debian | 13 | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| debian/python-3.12 | deb | debian | 13 | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
| debian/python-3.13 | deb | debian | 13 | <3.10.21 | 3.10.21 |
| debian/python-3.13 | deb | debian | 13 | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| debian/python-3.13 | deb | debian | 13 | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| debian/python-3.13 | deb | debian | 13 | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| debian/python-3.13 | deb | debian | 13 | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| debian/python-3.13 | deb | debian | 13 | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
| debian/python-3.14 | deb | debian | 13 | <3.10.21 | 3.10.21 |
| debian/python-3.14 | deb | debian | 13 | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| debian/python-3.14 | deb | debian | 13 | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| debian/python-3.14 | deb | debian | 13 | >=3.13.0-alpha1,<3.13.15 | 3.13.15 |
| debian/python-3.14 | deb | debian | 13 | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| debian/python-3.14 | deb | debian | 13 | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
| python | dhi | - | - | <3.10.21 | 3.10.21 |
| python | dhi | - | - | >=3.11.0-alpha1,<3.11.16 | 3.11.16 |
| python | dhi | - | - | >=3.12.0-alpha1,<3.12.14 | 3.12.14 |
| python | dhi | - | - | >=3.14.0-alpha1,<3.14.7 | 3.14.7 |
| python | dhi | - | - | >=3.15.0-alpha1,<3.15.0-rc1 | 3.15.0-rc1 |
Severity and metrics
No CVSS data available from this advisory.
NIST
CREATED
UPDATED
ADVISORY IDCVE-2026-18503
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
2.4lowUbuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-18503
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-