CVE-2026-3276: Potential DoS via quadratic complexity in unicodedata.normalize()
Potential DoS via quadratic complexity in unicodedata.normalize()
Other sources
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3276?
CVE-2026-3276 has a medium severity rating of 6.3 on the CVSS scale.
What potential risk does CVE-2026-3276 pose?
CVE-2026-3276 could lead to a denial of service (DoS) by causing excessive CPU time usage through specially crafted Unicode input.
How does CVE-2026-3276 affect the unicodedata.normalize() function?
CVE-2026-3276 can cause the unicodedata.normalize() function to exhibit quadratic complexity with certain long runs of combining characters.
Is CVE-2026-3276 present in all normalization forms?
Yes, CVE-2026-3276 affects all normalization forms within the unicodedata.normalize() function.
How can I mitigate the impact of CVE-2026-3276?
To mitigate CVE-2026-3276, avoid processing untrusted user input that may lead to excessive resource consumption when using unicodedata.normalize().