BIT-libpython-2026-3276: Potential DoS via quadratic complexity in unicodedata.normalize()

Published Jun 3, 2026

Updated

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

Affected Software

1 affected component

Python Software Foundation Python

Event History

Jun 3, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are needed to trigger the excessive CPU use?

An attacker must cause the application to normalize specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. The issue affects all Unicode normalization forms.

Which deployments are exposed?

Any deployment that invokes unicodedata.normalize() on attacker-controlled or otherwise untrusted Unicode input may be exposed to denial of service through excessive CPU consumption.

Does exploitation require authentication or user interaction?

The supplied severity vector indicates that the issue is remotely reachable with low attack complexity, requires no privileges or user interaction, and has an attack requirement condition.

BIT-libpython-2026-3276: Potential DoS via quadratic complexity in unicodedata.normalize()

Affected Software

Event History

Frequently Asked Questions

What conditions are needed to trigger the excessive CPU use?

Which deployments are exposed?

Does exploitation require authentication or user interaction?

Company

Resources

Contact

Frequently Asked Questions

What conditions are needed to trigger the excessive CPU use?

Which deployments are exposed?

Does exploitation require authentication or user interaction?