* SECURITY UPDATE: CPU denial-of-service in csv.Sniffer. Two independent regexes in Sniffer._guess_quote_and_delimiter() ran in super-linear time on samples reachable from the public csv.Sniffer.sniff() API (CWE-1176, algorithmic complexity). The quoted-field probe matched a field body with a lazy ".*?" under re.DOTALL, so a closing quote not followed by a delimiter was retried against every later quote in the sample: quadratic. The doubled-quote probe dq_regexp was unanchored, rescanned leading whitespace and ran even when no delimiter had been found, which is exponential on a sample carrying a run of quote characters. - debian/patches/CVE-2026-18503.patch: backport of cpython 19e5024518 (gh-109638, GH-154868) and fd78b565 (gh-98820, GH-154867), both in their upstream 3.10-branch form. Both commits are part of Python 3.10.21, the release the CVE record names as fixing the "0 to < 3.10.21" range, and gh-98820 alone leaves the doubled-quote probe exponential: with it applied on its own, sniff() on '"",'*100 + '"'*100 + '0' + '"'*100 + '0', on '"a"\n' + ' '*100000 with delimiters=',;', and on '"a" "b"\n' + ' '*100000 each still runs unbounded inside a single C-level re call. Field bodies are now matched by unrolled, unambiguous loops that cannot backtrack, the doubled-quote probe is anchored on whole fields and skipped when no delimiter was found, and sniff() normalises CRLF and CR to LF first so the probe's "$" means end of record. The 3.10 commits are used rather than the 3.11+ ones, which express the same fix with a possessive quantifier that Python 3.8's re module does not support. - CVE-2026-18503