EUVD-2026-55630
GHSA-2345-wr3r-cxf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted quoted CSV via application upload
-
DeliveryApplication passes unbounded sample to csv.Sniffer.sniff()
-
ExploitRegex heuristic triggers quadratic backtracking
-
ExecutionCPU core saturated
-
ImpactDegraded service availability
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires that the target application explicitly calls csv.Sniffer.sniff() with attacker-supplied data and does not cap the length of the sample before the call. The CVSS 4.0 vector specifies AV:L (local attack surface from the library's own perspective), PR:L (low privileges - the attacker must be able to submit input to the application), and UI:P (passive user interaction - the application must invoke sniff() on the input). Exploitation is further limited by the absence of any confidentiality or integrity impact; the sole effect is transient CPU saturation rated at low availability impact. Applications that specify a CSV dialect explicitly, truncate input to a fixed maximum length, or process CSV only from trusted internal sources are not exploitable. The vulnerability does not affect CSV parsing itself - only the auto-detection path in Sniffer.sniff(). |
| Impact | Available risk signals converge on low severity. The CVSS 4.0 base score of 2.4 (AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L) indicates local attack vector, low privilege requirement, passive user interaction, and only low availability impact with no confidentiality or integrity exposure. No CISA KEV listing exists and no public exploit or proof-of-concept is known. The 'Information Disclosure' tag applied to this CVE appears inconsistent with the description, which documents only CPU exhaustion - defenders should treat that tag as potentially mislabeled and not infer any data-exfiltration risk. Real-world exploitability is constrained to applications that (a) call csv.Sniffer.sniff() on user-supplied data and (b) impose no input length limits before that call. Applications that specify a CSV dialect explicitly or validate input size are not affected. The low CVSS availability impact rating further bounds the practical denial-of-service radius to degraded performance rather than outright service failure on modern multi-core systems. |
| Exploit ScenarioDerived | An attacker uploads a specially crafted CSV file composed of deeply nested quoted fields to a web application that uses csv.Sniffer.sniff() to auto-detect the file's format before processing. Because the application passes the full file content to sniff() without a size cap, the regex-based heuristic engages in quadratic backtracking, monopolizing a CPU core for the duration and degrading response times for other users. No public proof-of-concept is known, but the algorithmic nature of the flaw means it is straightforward to reproduce given knowledge of the regex patterns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 10, 2026
Super-linear regular-expression complexity in CPython's csv.Sniffer.sniff() allows CPU exhaustion when applications pass attacker-controlled, unbounded CSV input to dialect detection. Any Python application that auto-detects CSV formats from user-supplied data without input length limits is potentially affected across all CPython versions predating the 3.16 fix. No public exploit is identified at time of analysis, and the CVSS 4.0 score of 2.4 reflects a low-severity, local-context vulnerability with limited availability impact.
RemediationAI
The upstream fix is available in GitHub PR #153694 (https://github.com/python/cpython/pull/153694), which replaces the regex-based Sniffer heuristics with a trial-parsing algorithm that runs in linear time. A released, tagged CPython version containing this fix has not been independently confirmed - the change targets Python 3.16, which had not shipped at time of analysis. Until a patched release is available, the primary compensating control is to enforce a strict byte-length limit on any input passed to csv.Sniffer.sniff() - for example, capping samples at a few kilobytes - which eliminates the super-linear growth path with negligible functionality trade-off. Alternatively, specify the CSV dialect explicitly via csv.reader(f, delimiter=',') rather than relying on auto-detection, which avoids the vulnerable code path entirely. Applications that cannot adopt either approach should restrict CSV upload functionality to authenticated, rate-limited users to reduce abuse potential.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-1176 (Inefficient Regular Expression Complexity) within CPython's standard library csv.py Sniffer class. Prior to the fix, sniff() deduced CSV dialects using regex-based heuristics that matched isolated character fragments and analyzed character frequencies. This approach exhibited super-linear - potentially quadratic - time complexity on CSV samples containing quoted fields, because the regex engine could backtrack extensively on crafted inputs. The fix, visible in GitHub PR #153694, replaces the entire heuristic engine with an incremental trial-parsing approach: it iterates over plausible combinations of delimiter, quotechar, and escapechar, parses sample windows, eliminates clearly inferior combinations early, and expands the window progressively. The Python 3.16 What's New document explicitly states the old implementation 'takes quadratic time on quoted samples.' CPE cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:* covers all CPython versions.
Know when Cpython gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Local vector fits a library flaw; PR:L and UI:R reflect that an application with low-privilege input must invoke sniff(); only low availability impact applies.
Primary rating from Vendor (PSF).
CVSS VectorVendor: PSF
DescriptionCVE.org
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyon
A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CPython's tarfile.tar_filter extraction filter can be bypassed with crafted link members, allowing a malicious tar archi
Exploit-DB