PT-2026-45951 · Python+1 · Python+1

Bénédikt Tran + 6 · CVE-2026-3276 · Published 2026-06-03 · Updated 2026-08-01

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description The unicodedata.normalize() function can consume excessive CPU time when processing specially crafted Unicode input. This occurs when the input contains long sequences of combining characters with alternating Canonical Combining Class values, affecting all normalization forms.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-407

Related Identifiers

BIT-LIBPYTHON-2026-3276

BIT-PYTHON-2026-3276

BIT-PYTHON-MIN-2026-3276

CVE-2026-3276

ECHO-3BD2-A10B-BC48

OPENSUSE-SU-2026:11101-1

OPENSUSE-SU-2026:11181-1

OPENSUSE-SU-2026:11426-1

OPENSUSE-SU-2026:11427-1

OPENSUSE-SU-2026:11428-1

PSF-2026-25

USN-8509-1

Affected Products

Linuxmint

Python

References · 68

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3276.json · Exploit
• https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f · Patch
• https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0 · Patch
• https://github.com/python/cpython/pull/149080 · Patch
• https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32 · Patch
• https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598 · Patch
• https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:11426-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-9669 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8509-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2297 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8509-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3644 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4519 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-1502 · Vendor Advisory