Release date:
2026-08-31 13:03:55 UTC
Description:
* SECURITY UPDATE: csv.Sniffer._guess_quote_and_delimiter() probed the
sample with four dialect regexes whose quoted-field body was a lazy
".*?" compiled under re.DOTALL | re.MULTILINE. Because ".*?" is not
anchored to the first undoubled quote, every candidate start position
rescanned the sample to its end, so csv.Sniffer.sniff() on
attacker-supplied CSV - classically a single column of quoted values -
ran in quadratic time and could consume excessive CPU (CWE-1333,
inefficient regular expression complexity).
- debian/patches/CVE-2026-18503.patch: backport of cpython fd78b565
(gh-98820). The quoted-field body is rebuilt as an unrolled loop,
which is unambiguous and therefore does not backtrack. The 3.10
variant is used because the 3.11+ form relies on a possessive
quantifier that re in 3.9 cannot parse.
- CVE-2026-18503
Updated packages:
-
alt-python39_3.9.23-28_amd64.deb
sha:6761d42e0e0003384829194356ae9cf94d28e789
-
alt-python39-debug_3.9.23-28_amd64.deb
sha:5b38acf806be1990ee29ca19a1f63673995ea8d4
-
alt-python39-devel_3.9.23-28_amd64.deb
sha:601dc5f4414bcbd1a2c68dae0870411b2663bb1d
-
alt-python39-idle_3.9.23-28_amd64.deb
sha:2c5968fbf2e5574e8d535dd1dfd85c0dca2c1103
-
alt-python39-libs_3.9.23-28_amd64.deb
sha:da8f8c059e7b8007df729c7ed31ace3ea78c0a2e
-
alt-python39-test_3.9.23-28_amd64.deb
sha:950dda3359feb2fcfeb9eb6e178ffd3923cc555a
-
alt-python39-tkinter_3.9.23-28_amd64.deb
sha:00c247bd53643089bc19bc917d96fda404be1c04
-
alt-python39_3.9.23-28_arm64.deb
sha:b0116cedaaf573d7595738188049f10ecaf111ab
-
alt-python39-debug_3.9.23-28_arm64.deb
sha:dd05412f1eafff84fee895202170800b8d43e738
-
alt-python39-devel_3.9.23-28_arm64.deb
sha:b352d7d6a323779126c1a3c91b89d87a32f71f0d
-
alt-python39-idle_3.9.23-28_arm64.deb
sha:c98e1e01745fe836e5d3c3aef122b8213c179281
-
alt-python39-libs_3.9.23-28_arm64.deb
sha:3079b2ff48aabd825c44cd9a53cf8ab1ee818aac
-
alt-python39-test_3.9.23-28_arm64.deb
sha:a18ec51d04545223747ed85c4154d7622207cda9
-
alt-python39-tkinter_3.9.23-28_arm64.deb
sha:9c0cd05d889d328adc0910ade10d287c84b63131
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
