Release date:
2026-08-31 13:12:11 UTC
Description:
* SECURITY UPDATE: csv.Sniffer._guess_quote_and_delimiter() probed the
sample with four dialect regexes whose quoted-field body was a lazy
".*?" compiled under re.DOTALL | re.MULTILINE. Because ".*?" is not
anchored to the first undoubled quote, every candidate start position
rescanned the sample to its end, so csv.Sniffer.sniff() on
attacker-supplied CSV - classically a single column of quoted values -
ran in quadratic time and could consume excessive CPU (CWE-1333,
inefficient regular expression complexity).
- debian/patches/CVE-2026-18503.patch: backport of cpython fd78b565
(gh-98820). The quoted-field body is rebuilt as an unrolled loop,
which is unambiguous and therefore does not backtrack. The 3.10
variant is used because the 3.11+ form relies on a possessive
quantifier that re in 3.9 cannot parse.
- CVE-2026-18503
Updated packages:
-
alt-python39_3.9.23-28_amd64.deb
sha:9ffc3f48b2b77a93dad6c4bccd3b2b8dca4a6326
-
alt-python39-debug_3.9.23-28_amd64.deb
sha:65dd7bcaf0be6966d221a4d5e1c71676d7000ad5
-
alt-python39-devel_3.9.23-28_amd64.deb
sha:276c21feac16d5c40e2d3b8cf35e8723c47dd3c6
-
alt-python39-idle_3.9.23-28_amd64.deb
sha:06c83a74206e14ee4261e63ac0a0ed59188f3d8d
-
alt-python39-libs_3.9.23-28_amd64.deb
sha:fb748fa8c1fe2c79d018fd689d1bd7d66d17fe6a
-
alt-python39-test_3.9.23-28_amd64.deb
sha:792ab09b1303989c95f29a6f14645b306513bec1
-
alt-python39-tkinter_3.9.23-28_amd64.deb
sha:c874bf1dbc86ff9c4247931a9e37dea40115a2cb
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
