# CVE-2026-3276: Python CPython denial of service in unicodedata.normalize

Source: https://junglewise.ai/threats/cve-2026-3276-python-cpython-denial-of-service-in-unicodedata-normalize  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-3276 · Severity: info · CVSS 6.3 · Published 2026-06-03

A vulnerability in Python's standard library could allow an attacker to slow down or crash applications that process user-provided text. By submitting specially crafted Unicode text, an attacker can force the system to consume excessive processor resources. This can lead to a denial-of-service condition, impacting the availability of web services and applications that perform text normalization.

Technologies: [Python Software Foundation CPython](https://junglewise.ai/threats/technologies/cpython). Vendors: [Python Software Foundation](https://junglewise.ai/threats/vendors/python-software-foundation).

## Quick answers

**Is CVE-2026-3276 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3276 being exploited in the wild.

**How severe is CVE-2026-3276?** Informational severity, with a CVSS score of 6.3, published 3 June 2026.

**Which products and versions are affected?** Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15.

**Is there a fix for CVE-2026-3276?** A patch was published on 2026-06-02: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3276 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3276?** Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The unicodedata.normalize() function in CPython uses an insertion sort for the canonical ordering of combining characters, which exhibits O(n²) time complexity. An attacker can exploit this by providing a crafted Unicode string containing long runs of combining characters with alternating Canonical Combining Class (CCC) values. This inefficient sorting can lead to excessive CPU consumption; for example, a 0.5MB payload can occupy a CPU core for over 30 seconds. The issue affects all normalization forms (NFC, NFKC, NFD, NFKD). Patches introduce a hybrid sorting approach (counting sort for long runs) to reduce the worst-case complexity to O(n).

## Affected products

- Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15

## Timeline

- 2026-04-27: disclosed: Issue reported on GitHub and PR opened
- 2026-06-02: patched: Fix merged into CPython main branch
- 2026-06-03: advisory: Official security announcement and CVE publication

## References

- [https://github.com/python/cpython/issues/149079](https://github.com/python/cpython/issues/149079)
- [https://github.com/python/cpython/pull/149080](https://github.com/python/cpython/pull/149080)
- [https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/](https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/)

## Related threats

- [Python gzip/tarfile/zipfile CLI module shadowing via sys.path](https://junglewise.ai/threats/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to)
- [Python CPython quadratic complexity in xml.etree XPath index predicates](https://junglewise.ai/threats/cve-2026-6879-python-cpython-quadratic-complexity-in-xml-etree-xpath-index)
- [Python CPython CPU denial of service in html.parser.HTMLParser](https://junglewise.ai/threats/cve-2026-15308-python-cpython-cpu-denial-of-service-in-html-parser-htmlparser)
- [Python CPython improper permission preservation in tarfile.extract](https://junglewise.ai/threats/cve-2026-4360-python-cpython-improper-permission-preservation-in-tarfile-extract)
- [Python CPython infinite loop in tarfile streaming mode](https://junglewise.ai/threats/cve-2026-11972-python-cpython-infinite-loop-in-tarfile-streaming-mode)