Potential DoS via quadratic complexity in unicodedata.normalize()
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-3276US | — | — | ||
unicodedata.normalize() can take excessive CPU time when processing
specially crafted Unicode input containing long runs of combining characters
with alternating Canonical Combinin… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/06/03/15WEB
- https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0WEB
- https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598WEB
- https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26fWEB
- https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32WEB
- https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066WEB
- https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1fWEB
- https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408baccWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan