The vulnerability resides in CPython’s csv.Sniffer.sniff() routine, which uses regular expressions to infer the dialect of CSV data. When supplied with attacker‑controlled, unbounded input, the regex engine can perform super‑linear work that consumes significant CPU cycles. This can lead to a denial‑of‑service condition for applications that parse large or malicious CSV files, causing performance degradation or unavailability for legitimate users.

The issue affects the Python Software Foundation CPython implementation. No specific version range is listed, so any release that still uses the unpatched csv.Sniffer implementation may be vulnerable.

The CVSS score is 2.4, indicating a low overall severity, while the EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves passing large, malicious CSV data to an application that calls csv.Sniffer.sniff() without bounds, such as through file uploads, network streams, or local IPC, which can trigger the CPU‑intensive regex processing. Although the exploitation probability is low, the high CPU footprint makes the flaw a viable denial‑of‑service vector.