Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-18503 is a denial of service vulnerability caused by inefficient regular expression processing in the csv.Sniffer.sniff() function of Python 3.10. An attacker can supply specially crafted CSV samples that trigger super-linear regex backtracking during dialect sniffing, resulting in high CPU usage. Red Hat identified this issue in their Hardened Images RPMs containing Python 3.10 packages and issued an update to python3.10-3.10.21-1.hum1 and related packages for aarch64 and x86_64 architectures. The vulnerability has low severity and limited impact since most applications do not invoke sniff() on untrusted or unbounded input.

The vulnerability can cause denial of service by consuming excessive CPU resources when processing maliciously crafted CSV input with the csv.Sniffer.sniff() function. There is no impact on confidentiality or integrity. The issue is rated low severity by Red Hat. Most applications are unaffected as they use csv.reader() or csv.DictReader() without sniffing. The impact is limited to applications that invoke sniff() on untrusted or large CSV samples.

Red Hat has released updated python3.10 packages (version 3.10.21-1.hum1) that fix this issue. Users should apply these updates to mitigate the vulnerability. If updating is not immediately possible, avoid passing untrusted or unbounded CSV input to csv.Sniffer.sniff(). Limit the size of the sample passed to sniff() or use a known CSV dialect directly with csv.reader().