https://seclists.org/oss-sec/2026/q2/801: [oss-security][CVE-2026-3276] Potential DoS via quadratic complexity in unicodedata.normalize()
Published Jun 3, 2026
·Updated
Affected Software
1 affected component
Python Software Foundation CPython
Frequently Asked Questions
1
What is the severity of CVE-2026-3276?
CVE-2026-3276 has been classified as a MEDIUM severity vulnerability.
2
How can I mitigate CVE-2026-3276?
To mitigate CVE-2026-3276, avoid using the unicodedata.normalize() function with input that may cause excessive computational complexity.
3
What does CVE-2026-3276 affect?
CVE-2026-3276 affects the CPython implementation of the Python programming language.
4
What kind of vulnerability is CVE-2026-3276?
CVE-2026-3276 is a potential Denial of Service (DoS) vulnerability due to quadratic time complexity.
5
When was CVE-2026-3276 published?
CVE-2026-3276 was published on June 3, 2026.