Executive brief
Python's csv.Sniffer module, used to automatically detect CSV file formats, contains a regular expression vulnerability that can be exploited by attackers through maliciously crafted CSV samples. An attacker can craft input that causes the sniffer to perform excessive CPU work with super-linear complexity, potentially leading to application slowdowns or denial of service when the application processes untrusted CSV data.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) in Python's csv.Sniffer.sniff() method, specifically in the regular expressions used to detect quoted fields during CSV dialect sniffing. The regex pattern uses lazy matching to find the closing quote of a field, causing catastrophic backtracking when a closing quote is not followed by an expected delimiter. An attacker can provide a crafted CSV sample with many quotes and non-matching delimiters, forcing the regex engine to retry patterns across the entire input, resulting in quadratic or super-linear time complexity. The vulnerability is triggered only when applications pass unbounded or attacker-controlled input to csv.Sniffer.sniff(). Fixes have been applied to Python 3.12, 3.15, and later versions by changing the regex to use possessive matching instead of lazy matching.
Affected products
- Python CPython 3.12 and earlier (patched in 3.12+, 3.15+)
Timeline
- 2026-08-10: disclosed
- 2024: patched: Fixes committed to CPython 3.12 and 3.15 branches