VULNERABILITY INTELLIGENCE
CVE-2026-3276
EPSS probability0.49%
CISA KEVNot currently listed
Published2026-06-03
Last modified2026-08-13
Description
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Weakness classification
- cna@python.org: CWE-407