Release date:
2026-08-31 13:46:27 UTC
Description:
* SECURITY UPDATE: csv.Sniffer._guess_quote_and_delimiter() probed the
sample with four dialect regexes whose quoted-field body was a lazy
".*?" compiled under re.DOTALL | re.MULTILINE. Because ".*?" is not
anchored to the first undoubled quote, every candidate start position
rescanned the sample to its end, so csv.Sniffer.sniff() on
attacker-supplied CSV - classically a single column of quoted values -
ran in quadratic time and could consume excessive CPU (CWE-1333,
inefficient regular expression complexity).
- debian/patches/CVE-2026-18503.patch: backport of cpython fd78b565
(gh-98820). The quoted-field body is rebuilt as an unrolled loop,
which is unambiguous and therefore does not backtrack. The 3.10
variant is used because the 3.11+ form relies on a possessive
quantifier that re in 3.9 cannot parse.
- CVE-2026-18503
Updated packages:
-
alt-python39_3.9.23-28_amd64.deb
sha:b14822a06b1c083b03804748b3f29cf760b9a6a4
-
alt-python39-debug_3.9.23-28_amd64.deb
sha:5b38acf806be1990ee29ca19a1f63673995ea8d4
-
alt-python39-devel_3.9.23-28_amd64.deb
sha:391cd9ac48a239037edbe3e2e10debf97909d6e2
-
alt-python39-idle_3.9.23-28_amd64.deb
sha:21b87bba7224f06592cc251845d54e571ce03760
-
alt-python39-libs_3.9.23-28_amd64.deb
sha:69251d8b8b742d81767049b385b0c6f6a44ae646
-
alt-python39-test_3.9.23-28_amd64.deb
sha:d5a8a2a9a9b524980ec6cad27e1a6bc6fcd23175
-
alt-python39-tkinter_3.9.23-28_amd64.deb
sha:c511c404cbaf6a75f8fd2246583a5efe9ba3b9cf
-
alt-python39_3.9.23-28_arm64.deb
sha:b032e9e122228f6b0a1d9e478c636790c47d1279
-
alt-python39-debug_3.9.23-28_arm64.deb
sha:dd05412f1eafff84fee895202170800b8d43e738
-
alt-python39-devel_3.9.23-28_arm64.deb
sha:3e6a6ddf0a586c000eeef7a15d6c08cc36233909
-
alt-python39-idle_3.9.23-28_arm64.deb
sha:ddd1966a8aca337c0685fa3309a4ce81e146a3ec
-
alt-python39-libs_3.9.23-28_arm64.deb
sha:66e1d53a36b3f4e84de40a8fc10ffa6df4478a91
-
alt-python39-test_3.9.23-28_arm64.deb
sha:65ad24b9c218e20a53deaca8ef0a9d785c70cd9e
-
alt-python39-tkinter_3.9.23-28_arm64.deb
sha:dc7db69bea5f14b5ec9f70c9280461144393b8f5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
