CVE-2026-3276
Python vulnerabilities
Description
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Metrics
Weakness classes (CWE)
CWE-407Class
Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
cwe.mitre.org →
Reanalysis & status changes
Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.
- CVE Modified2026-08-11 01:17 UTC· cna@python.org
- Reference: https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc
- Reference: https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c
- CVE Translated2026-07-22 19:10 UTC· nvd@nist.gov
- Translation: Title: CPython de Python Software Foundation, Description: unicodedata.normalize() puede consumir un tiempo excesivo de CPU al procesar entradas Unicode especialmente diseñadas que contienen largas secuencias de caracteres combinatorios con valores de Clase de Combinación Canónica alternos. Esto afecta a todas las formas de normalización.
- CVE Modified2026-06-16 15:16 UTC· cna@python.org
- Reference: https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598
Affected operating systems
linux
debian / debian_linux10.0
linux
debian / debian_linux11.0
linux
redhat / enterprise_linux8.0
linux
ubuntu / python2.7bionic
linux
ubuntu / python2.7focal
linux
ubuntu / python2.7jammy
linux
ubuntu / python2.7trusty
linux
ubuntu / python2.7xenial
linux
ubuntu / python3.10jammy
linux
ubuntu / python3.11jammy
linux
ubuntu / python3.12noble
linux
ubuntu / python3.14resolute
linux
ubuntu / python3.4trusty
linux
ubuntu / python3.5trusty
linux
ubuntu / python3.5xenial
linux
ubuntu / python3.6bionic
linux
ubuntu / python3.7bionic
linux
ubuntu / python3.8bionic
linux
ubuntu / python3.8focal
linux
ubuntu / python3.9focal
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
bitnami
python-min3.10.0
bitnami
python-min3.11.0
bitnami
python-min3.12.0
bitnami
python-min3.13.0
bitnami
python-min3.14.0
bitnami
python-min3.6.0
bitnami
python-min3.7.0
bitnami
python-min3.8.0
bitnami
python-min3.9.0
python
python3.14.0 – 3.14.4
python
python3.13.13
python
python
python-markdown
markdown
References & sources
- https://github.com/python/cpython/issues/145506report
- https://github.com/python/cpython/pull/145507web
- https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603efix
- https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535efix
- https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86fix
- https://github.com/python/cpython/commit/69ddd9bb2cc4bd69b1565647c18659c6a789ccd9fix
- https://github.com/python/cpython/commit/876858c9f65d9ab656c7fa639f268ce7856d89ddfix
- https://github.com/python/cpython/commit/c70adad78caeeea33f92f560ecb93331ca11bf66patch
- http://www.openwall.com/lists/oss-security/2026/03/05/6
- https://github.com/python/cpython/pull/146212web
- https://github.com/python/cpython/issues/146211report
- https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/advisory
- https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69fix
- https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2edfix
- https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8ddfix
- https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ecfix
- https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53fix
- https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3efix
- http://www.openwall.com/lists/oss-security/2026/04/11/4
- https://nvd.nist.gov/vuln/detail/CVE-2026-1502web
Linked CVEs
- CVE-2026-9669
bz2.BZ2Decompressor objects could be reused after a decompression error.
high - CVE-2026-8328
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed.
medium - CVE-2026-7774
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect late…
medium - CVE-2026-6100
A flaw was found in Python's decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`.
criticalCVSSv3 8.1 - CVE-2026-6019
A flaw was found in Python's `http.cookies` module.
mediumCVSSv3 6.1 - CVE-2026-5713
A flaw was found in Python.
medium - CVE-2026-4786
A flaw was found in the Python webbrowser.open() API.
highCVSSv3 7.1 - CVE-2026-4519
A flaw was found in Python.
highCVSSv3 7.1 - CVE-2026-4224
A stack overflow flaw has been discovered in the python pyexpat module.
highCVSSv3 7.5 - CVE-2026-3644
A control character validation flaw has been discovered in the Python http.cookie module.
highCVSSv3 7.5 - CVE-2026-2297
A flaw was found in CPython.
medium - CVE-2026-1502
A flaw was found in Python.
medium - CVE-2026-1299
A flaw was found in the email module in the Python standard library.
medium - CVE-2026-0672
An injection flaw has been discovered in Python.
medium - CVE-2025-69534
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unha…
highCVSSv3 7.5 - CVE-2025-13462
A flaw was found in the `tarfile` module of cpython.
lowCVSSv3 3.3 - CVE-2021-4189
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode.
mediumCVSSv3 5.3