Skip to main content

CPython CVE-2026-3276

| EUVDEUVD-2026-34103 MEDIUM
Inefficient Algorithmic Complexity (CWE-407)
2026-06-03 PSF GHSA-jg6j-874m-wgjj
Information Disclosure Canonical Cpython Python Software Foundation
6.3
CVSS 4.0 · Vendor: PSF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Submit crafted Unicode payload via network request
  2. Delivery
    Application passes input to unicodedata.normalize()
  3. Exploit
    Quadratic insertion sort triggers on long combining-character run
  4. Execution
    CPU exhaustion per normalization call
  5. Persist
    Repeated requests saturate server CPU
  6. Impact
    Denial of service to legitimate users

Vulnerability Assessment

Weakness
CWE
CWE-407
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
Exploitation Conditions

The target application must call unicodedata.normalize() (any of NFD, NFKD, NFC, NFKC) with input that is at least partially controlled by the attacker. The vulnerability is triggered specifically by long consecutive runs of combining characters (Unicode non-starters with non-zero CCC values) in non-canonical order, particularly when CCC values alternate rather than monotonically increase. The CVSS AT:P signals this prerequisite. Exploitation is limited by: (1) the application must expose a code path that normalizes untrusted Unicode without prior length or content filtering; (2) effectiveness scales with run length - the quadratic degradation becomes significant only with runs longer than ~20 combining characters; (3) the attacker must be able to send multiple requests to sustain CPU pressure. No authentication is required (PR:N), and no user interaction is needed (UI:N). Single requests produce partial availability impact; sustained attack amplifies effect.
Impact

CVSS 4.0 scores this at 6.3 (Medium), which is well-calibrated for this vulnerability. The vector AV:N/AC:L/AT:P/PR:N/UI:N reflects network reachability with no authentication required, but the AT:P (Attack Requirements: Present) accurately captures that exploitation depends on a specific application-level prerequisite: the target service must pass attacker-controlled input to unicodedata.normalize(). The impact is limited exclusively to availability of the vulnerable component (VA:L) with no confidentiality or integrity impact, consistent with a pure CPU-exhaustion DoS. The 'Information Disclosure' tag from the intelligence feed appears inconsistent with the technical description and CVSS impact scores; this is likely a tagging error and should not be treated as confirmed. No public exploit code has been identified and this vulnerability is not in CISA KEV, suggesting opportunistic mass exploitation is not currently occurring. However, the algorithmic nature of the bug means any application that normalizes untrusted Unicode input - common in web frameworks, form processors, username validators, and internationalization pipelines - is realistically exposed. A 65-character payload is sufficient to trigger the behavior, lowering the bar considerably.
Exploit ScenarioDerived

An attacker submits a crafted form field or API parameter containing a string like 'a' followed by 64 characters alternating between U+0300 (combining grave accent, CCC=230) and U+0327 (combining cedilla, CCC=202). If the target application passes this input to unicodedata.normalize() without length or content restrictions - common in username normalization, search indexing, or text processing endpoints - the quadratic sort triggers extended CPU consumption per request. By submitting many such requests concurrently, the attacker can saturate CPU resources and deny service to legitimate users. No public exploit code exists, but the PR test cases provide a functional reproduction template.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 03, 2026

Denial-of-service via quadratic algorithmic complexity in CPython's unicodedata.normalize() affects all CPython versions when processing attacker-controlled Unicode strings. The canonical ordering step during Unicode normalization used an insertion sort algorithm with O(n²) time complexity, which degrades severely when input contains long runs of combining characters with alternating Canonical Combining Class (CCC) values. An unauthenticated remote attacker can cause excessive CPU consumption by submitting small crafted payloads (e.g., 65 characters) to any service that passes untrusted input to unicodedata.normalize(). No public exploit code or CISA KEV listing exists at time of analysis.

RemediationAI

The upstream fix is available as GitHub pull request https://github.com/python/cpython/pull/149080, which replaces the quadratic insertion sort with a linear counting sort for combining character runs exceeding a threshold of 20 characters. However, a released patched CPython version (e.g., 3.x.y) has not been independently confirmed from the available data - the fix reference points to a PR/commit, not a tagged release. Monitor the PSF security announcement at https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/ for an official patched release. As a compensating control until a patch is applied, application-layer defenses should validate or limit the length and character composition of Unicode input before passing it to unicodedata.normalize() - specifically, rejecting strings with abnormally high ratios of combining characters (Unicode category 'M') relative to base characters. Setting a maximum input length for normalization calls is also effective. Both controls introduce the trade-off of potentially rejecting legitimate internationalized input in some edge cases.

Affected VersionsENISA

CPython 0

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in CPython's C-level unicodedata module (Modules/unicodedata.c), specifically in the nfd_nfkd() function responsible for Unicode normalization (NFD, NFKD, NFC, NFKC forms). Per CWE-407 (Inefficient Algorithmic Complexity), the root cause is an insertion sort used for canonical reordering of combining character runs. Unicode normalization requires sorting consecutive non-starter characters by their Canonical Combining Class (CCC) value (0-255). When a long run of characters alternates between two CCC values (e.g., U+0300 CCC=230 and U+0327 CCC=202), the insertion sort degrades to O(n²) comparisons and swaps. The fix, visible in PR #149080, introduces a threshold-based strategy: runs shorter than 20 characters continue to use insertion sort, while longer runs switch to a stable counting sort with O(n) time complexity, eliminating the quadratic behavior. The affected CPE is cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*, indicating all CPython versions are affected.

Know when Cpython gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (PSF) PRIMARY 6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.3 MEDIUM

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
CVSS changed
Jun 03, 2026 - 16:22 NVD
6.3 (MEDIUM)
CVE Published
Jun 03, 2026 - 14:29 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

Threat Intelligence Overview

EPSS Score
0.0%
Top 87% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Cpython

View all
CVE-2026-17084 MEDIUM POC
6.0 Aug 18

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CVE-2026-115557 CRITICAL
9.4 Oct 24

CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyon
CVE-2026-19445 CRITICAL
9.2 Sep 30

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-11972 HIGH
8.2 Jun 23

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-19553 HIGH
7.6 Sep 30

Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-114583 MEDIUM
6.9 Oct 22

CPython's tarfile.tar_filter extraction filter can be bypassed with crafted link members, allowing a malicious tar archi

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-54892 HIGH POC
8.7
CVE-2026-90776 HIGH POC
8.7
CVE-2026-59094 HIGH POC
8.7
CVE-2026-13311 HIGH POC
8.7
CVE-2026-54284 HIGH POC
8.7
CVE-2022-45061 HIGH POC
7.5
CVE-2026-71321 HIGH POC
7.5
CVE-2026-56669 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed

References

Advisories & patches
PATCH https://github.com/python/cpython/pull/149080 ADVISORY https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-3276 ADVISORY https://seclists.org/oss-sec/2026/q2/801 ADVISORY https://ubuntu.com/security/notices/USN-8509-1 ADVISORY https://vuldb.com/vuln/368143 REF http://www.openwall.com/lists/oss-security/2026/06/03/15 REF https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0 REF https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598 REF https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f REF https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32 REF https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066 REF https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f REF https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc REF https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c REF https://github.com/python/cpython/issues/149079

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy