This vulnerability arises from the csv.Sniffer.sniff() method in CPython, where attacker-controlled CSV samples can cause super-linear regular-expression work during dialect sniffing. This results in excessive CPU usage when applications process unbounded input through this method. The issue is identified as CWE-1176 and affects CPython versions before 3.16.0, specifically including 3.14.0 and 3.15.0a1. The CVSS 4.0 base score is 2.4, indicating low severity. No official patch or remediation level has been provided by the vendor at this time.

The vulnerability can cause significant CPU resource consumption due to super-linear regular-expression processing when untrusted CSV input is passed to csv.Sniffer.sniff(). This may degrade application performance or availability but does not indicate direct code execution or data compromise. The low CVSS score reflects limited impact confined to resource exhaustion under specific conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should avoid passing unbounded or untrusted CSV input to csv.Sniffer.sniff() or implement input size restrictions to mitigate potential CPU exhaustion.