Login Request a demo
Medium severity · published Jun 3, 2026
CVE-2026-3276
Potential DoS via quadratic complexity in unicodedata.normalize()
6.3
CVSS
0.5%
EPSS
No
On KEV
Description
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.14; 3.14.0 before 3.14.6; 3.15.0a1 before 3.15.0b2 · source: vendor
Affected product
CP
CPython
Python Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3276
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3276
github.com
https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0
github.com
https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598
github.com
https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f
github.com
https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32
github.com
https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066
github.com
https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.4
CVE-2026-82049
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
8.2
CVE-2026-11972
tarfile opened in streaming mode mishandles EOF