CVE-2026-3276 — Potential DoS via quadratic complexity in unicodedata.normalize()
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combi…
Published: 2026-06-03 · CVSS: 6.3 · CVSS 4.0
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7