Release date:
2026-08-31 12:46:04 UTC
Description:
* SECURITY UPDATE: csv.Sniffer._guess_quote_and_delimiter() probed the
sample with four dialect regexes whose quoted-field body was a lazy
".*?" compiled under re.DOTALL | re.MULTILINE. Because ".*?" is not
anchored to the first undoubled quote, every candidate start position
rescanned the sample to its end, so csv.Sniffer.sniff() on
attacker-supplied CSV - classically a single column of quoted values -
ran in quadratic time and could consume excessive CPU (CWE-1333,
inefficient regular expression complexity).
- debian/patches/CVE-2026-18503.patch: backport of cpython fd78b565
(gh-98820). The quoted-field body is rebuilt as an unrolled loop,
which is unambiguous and therefore does not backtrack. The 3.10
variant is used because the 3.11+ form relies on a possessive
quantifier that re in 3.9 cannot parse.
- CVE-2026-18503
Updated packages:
-
alt-python39_3.9.23-28_amd64.deb
sha:18a8809c30e3c6255d4577d271048cd399f34efe
-
alt-python39-debug_3.9.23-28_amd64.deb
sha:74c8ae1ce7107035f29dbc98913046ca603a4a64
-
alt-python39-devel_3.9.23-28_amd64.deb
sha:0171b903a034a9a6c0e61a84c681ec1e9edb4a41
-
alt-python39-idle_3.9.23-28_amd64.deb
sha:4b4e62338201f31d96ba13cb64dfbfdcad2b0d75
-
alt-python39-libs_3.9.23-28_amd64.deb
sha:ebb3103b7b7ae233006348b574bc30f49e2e75af
-
alt-python39-test_3.9.23-28_amd64.deb
sha:d8157e175a9b478cf087f6668bff2e47cc20b784
-
alt-python39-tkinter_3.9.23-28_amd64.deb
sha:1c3caf7d95e0bf3c609beabde101d89d3f748e4e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
