PT-2026-45951 · Python · Cpython

Bénédikt Tran + 6 · Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-3276

NVD

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

Fix

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2026-3276

Affected Products

Cpython

References · 4

• https://github.com/python/cpython/pull/149080 · Patch
• https://mail.python.org/archives/list/[e-mail]/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3276 · Security Note
• https://github.com/python/cpython/issues/149079 · Note