- CVE-2026-18503: csv.Sniffer._guess_quote_and_delimiter() probed the sample with four dialect regexes whose quoted-field body was a lazy ".*?" compiled under re.DOTALL | re.MULTILINE. Because ".*?" is not anchored to the first undoubled quote, every candidate start position rescanned the sample to its end, so csv.Sniffer.sniff() on attacker-supplied CSV - classically a single column of quoted values - ran in quadratic time and could consume excessive CPU (CWE-1333, inefficient regular expression complexity). Backport of cpython fd78b565 (gh-98820): the body is rebuilt as an unrolled loop, which is unambiguous and therefore does not backtrack. The 3.10 variant is used because the 3.11+ form relies on a possessive quantifier that re in 3.9 cannot parse.