Is CVE-2026-3276 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3276 being exploited in the wild.

How severe is CVE-2026-3276?

Informational severity, with a CVSS score of 6.3, published 3 June 2026.

Which products and versions are affected?

Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15.

Is there a fix for CVE-2026-3276?

A patch was published on 2026-06-02: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3276 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3276?

Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3276: Python CPython denial of service in unicodedata.normalize

CVE-2026-3276 · Severity: info · CVSS 6.3 · Published 2026-06-03

A vulnerability in Python's standard library could allow an attacker to slow down or crash applications that process user-provided text. By submitting specially crafted Unicode text, an attacker can force the system to consume excessive processor resources. This can lead to a denial-of-service condition, impacting the availability of web services and applications that perform text normalization.

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Quick answers

Is CVE-2026-3276 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3276 being exploited in the wild.
How severe is CVE-2026-3276?: Informational severity, with a CVSS score of 6.3, published 3 June 2026.
Which products and versions are affected?: Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15.
Is there a fix for CVE-2026-3276?: A patch was published on 2026-06-02: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3276 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3276?: Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The unicodedata.normalize() function in CPython uses an insertion sort for the canonical ordering of combining characters, which exhibits O(n²) time complexity. An attacker can exploit this by providing a crafted Unicode string containing long runs of combining characters with alternating Canonical Combining Class (CCC) values. This inefficient sorting can lead to excessive CPU consumption; for example, a 0.5MB payload can occupy a CPU core for over 30 seconds. The issue affects all normalization forms (NFC, NFKC, NFD, NFKD). Patches introduce a hybrid sorting approach (counting sort for long runs) to reduce the worst-case complexity to O(n).

Affected products

Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15

Timeline

2026-04-27: disclosed: Issue reported on GitHub and PR opened
2026-06-02: patched: Fix merged into CPython main branch
2026-06-03: advisory: Official security announcement and CVE publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.