CVE-2026-3276CWE-407

CVE-2026-3276

published June 3, 2026

CVSS
6.3
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

unicodedata.normalize() can take excessive CPU time when processing

specially crafted Unicode input containing long runs of combining characters

with alternating Canonical Combining Class values.

This affects all normalization forms.

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Weakness
CWE-407 · Inefficient Algorithmic Complexity
Published
2026-06-03T20:16Z
References (12)
https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0 · [email protected]https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598 · [email protected]https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f · [email protected]https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32 · [email protected]https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066 · [email protected]https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f · [email protected]https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc · [email protected]https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c · [email protected]https://github.com/python/cpython/issues/149079 · [email protected]https://github.com/python/cpython/pull/149080 · [email protected]https://mail.python.org/archives/list/[email protected]/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/ · [email protected]http://www.openwall.com/lists/oss-security/2026/06/03/15 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 JUN 14:29Z
    Potential DoS via quadratic complexity in unicodedata.normalize()
    cvelistv5