EUVD-2026-55630
GHSA-2345-wr3r-cxf2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector fits a library flaw; PR:L and UI:R reflect that an application with low-privilege input must invoke sniff(); only low availability impact applies.
Primary rating from Vendor (PSF).
CVSS VectorVendor: PSF
Lifecycle Timeline
3DescriptionCVE.org
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
AnalysisAI
Super-linear regular-expression complexity in CPython's csv.Sniffer.sniff() allows CPU exhaustion when applications pass attacker-controlled, unbounded CSV input to dialect detection. Any Python application that auto-detects CSV formats from user-supplied data without input length limits is potentially affected across all CPython versions predating the 3.16 fix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application explicitly calls csv.Sniffer.sniff() with attacker-supplied data and does not cap the length of the sample before the call. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Available risk signals converge on low severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is available in GitHub PR #153694 (https://github.com/python/cpython/pull/153694), which replaces the regex-based Sniffer heuristics with a trial-parsing algorithm that runs in linear time. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and
CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p
XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo
Denial-of-service via quadratic algorithmic complexity in CPython's unicodedata.normalize() affects all CPython versions
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today