CVE-2026-3276

MEDIUM

Python Software Foundation CPython - Potential DoS via Quadratic Complexity in unicodedata.normalize()

Title source: rule
STIX 2.1

Description

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

References (8)

Core 8
Core References
Issue Tracking issue-tracking
https://github.com/python/cpython/issues/149079

Scores

CVSS v4 6.3
EPSS 0.0041
EPSS Percentile 32.6%
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-407
Status published
Products (5)
Python Software Foundation/CPython
Python Software Foundation/CPython < 3.13.14
Python Software Foundation/CPython < 3.15.0b2
Python Software Foundation/CPython 3.14.0 - 3.14.6
Python Software Foundation/CPython 3.15.0a1 - 3.15.0b2
Published Jun 03, 2026
Tracked Since Jun 03, 2026