What’s Vulnerable › Vulnerabilities

CVE-2026-3276: Potential DoS via quadratic complexity in unicodedata.normalize()

• Severity: medium (CVSS 6.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-03 · updated 2026-08-13
• Weakness: CWE-407

Description

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

Affected products

• Python: before 3.10.21; from 3.11.0 before 3.11.16; from 3.12.0 before 3.12.14; from 3.13.0 before 3.13.14; from 3.14.0 before 3.14.6; from 3.15.0a1 before 3.15.0b2 — fixed in 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.6, 3.15.0b2

How to fix

Upgrade to a fixed version: Python 3.10.21, 3.11.16, 3.12.14, 3.13.14. Check the vendor advisory for mitigations.

References

• https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0
• https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598
• https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f
• https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32
• https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066
• https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f
• https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc
• https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c
• https://github.com/python/cpython/issues/149079
• https://github.com/python/cpython/pull/149080
• https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/
• http://www.openwall.com/lists/oss-security/2026/06/03/15

Get alerted when CVE-2026-3276 or the next vulnerability affects your stack