6.3

CVE-2026-3276

Potential DoS via quadratic complexity in unicodedata.normalize()

unicodedata.normalize() can take excessive CPU time when processing
specially crafted Unicode input containing long runs of combining characters
with alternating Canonical Combining Class values.
This affects all normalization forms.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerPython Software Foundation
≫
Produkt CPython
Default Statusunaffected
Version 0
Version < 3.13.14
Status affected
Version 3.14.0
Version < 3.14.6
Status affected
Version 3.15.0a1
Version < 3.15.0b2
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.384
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cna@python.org 6.3 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-407 Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/
https://github.com/python/cpython/pull/149080
https://github.com/python/cpython/issues/149079
http://www.openwall.com/lists/oss-security/2026/06/03/15
https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0
https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f
https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32
https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066
https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598