- CVE-2026-18503: CPU denial-of-service in csv.Sniffer. Two independent regexes in Sniffer._guess_quote_and_delimiter() ran in super-linear time on samples reachable from the public csv.Sniffer.sniff() API (CWE-1176). The quoted-field probe matched a field body with a lazy ".*?" under re.DOTALL, retrying every closing quote against every later quote in the sample: quadratic. The doubled-quote probe dq_regexp was unanchored, rescanned leading whitespace and ran even when no delimiter had been found, which is exponential on a sample carrying a run of quote characters. Backport of cpython 19e5024518 (gh-109638) and fd78b565 (gh-98820), both in their 3.10 form; both are part of Python 3.10.21, the release the CVE record names as fixing the "0 to < 3.10.21" range, and gh-98820 alone leaves the doubled-quote probe exponential. The 3.10 variants are required because the 3.11+ ones use a possessive quantifier, unsupported by Python 3.8's re module.