Executive brief
A vulnerability in Python's standard library could allow an attacker to slow down or crash applications that process user-provided text. By submitting specially crafted Unicode text, an attacker can force the system to consume excessive processor resources. This can lead to a denial-of-service condition, impacting the availability of web services and applications that perform text normalization.
Technical details
The unicodedata.normalize() function in CPython uses an insertion sort for the canonical ordering of combining characters, which exhibits O(n²) time complexity. An attacker can exploit this by providing a crafted Unicode string containing long runs of combining characters with alternating Canonical Combining Class (CCC) values. This inefficient sorting can lead to excessive CPU consumption; for example, a 0.5MB payload can occupy a CPU core for over 30 seconds. The issue affects all normalization forms (NFC, NFKC, NFD, NFKD). Patches introduce a hybrid sorting approach (counting sort for long runs) to reduce the worst-case complexity to O(n).
Affected products
- Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15
Timeline
- 2026-04-27: disclosed: Issue reported on GitHub and PR opened
- 2026-06-02: patched: Fix merged into CPython main branch
- 2026-06-03: advisory: Official security announcement and CVE publication