CVE-2026-3276

What it actually does

The flaw is an algorithmic complexity denial-of-service issue in Python's Unicode normalization path. When unicodedata.normalize() processes specially crafted Unicode strings containing long sequences of combining characters with alternating Canonical Combining Class values, normalization can consume excessive CPU time across all normalization forms: NFC, NFD, NFKC, and NFKD. Applications are exposed when they accept attacker-controlled text and normalize it synchronously in request handling, authentication, search, validation, logging, import, messaging, or data-processing workflows.

Why it matters to the business

An attacker may be able to slow or exhaust CPU resources in services that normalize untrusted Unicode input, causing degraded performance, request timeouts, worker exhaustion, failed background jobs, or partial service outage. The current public exploitation signal is low: EPSS is 0.00486 with no 30-day upward trend, it is not listed in CISA KEV, and no exploit maturity is reported; however, exposure can be widespread because Unicode normalization is commonly used indirectly by web frameworks, identity flows, search/indexing, data ingestion, and text-processing features.

How an attack unfolds

An attacker first identifies an application path that accepts free-form Unicode input and later passes that input to unicodedata.normalize() or a dependent library that calls it. The attacker submits a crafted string containing long runs of combining characters whose Canonical Combining Class values alternate in a way that triggers inefficient normalization behavior. Because the attack does not require authentication or user interaction when the vulnerable path is publicly reachable, repeated requests can force application workers or background processors to spend disproportionate CPU time on normalization. At scale, this can increase latency, trigger request timeouts, reduce throughput, exhaust worker pools, and create a denial-of-service condition without needing code execution or data access.

How to fix it

Upgrade to a Python runtime or vendor package version that includes the fix once provided by the relevant Python distribution, operating system vendor, container base image, or managed runtime provider. Because no fixed versions were supplied in the input, remediation should be tracked against official Python security advisories and downstream vendor advisories for the deployed runtime versions. As interim mitigations, enforce maximum input lengths before Unicode normalization, reject or truncate unusually long runs of combining marks, apply per-request CPU/time limits, isolate expensive text-processing work from request threads, rate-limit unauthenticated text-submission endpoints, and ensure worker pools have timeout and backpressure controls. Review transitive uses of unicodedata.normalize() in application code and dependencies, especially in authentication, search, validation, slug generation, canonicalization, and ingestion paths.

How to confirm the fix worked

Confirm the runtime version in deployed applications, containers, serverless functions, CI images, and batch workers against official fixed-version guidance from Python or the relevant vendor. Use software composition analysis and runtime inventory to locate Python components that import unicodedata or call unicodedata.normalize(). Test exposed text-processing endpoints with safe, rate-limited synthetic inputs containing long combining-character sequences and verify that CPU time, latency, and worker utilization remain bounded after remediation or mitigation. Validate that input length limits are applied before normalization, that excessive combining mark runs are rejected, and that request/job timeouts recover cleanly without worker starvation.

Typical attack path

1. Find an externally reachable feature that accepts arbitrary Unicode text, such as usernames, display names, search terms, form fields, file metadata, comments, API payloads, or import data.
2. Determine whether the application normalizes submitted text using Python unicodedata.normalize() or a library/framework that relies on it.
3. Generate payloads with very long sequences of Unicode combining characters with alternating Canonical Combining Class values.
4. Submit the crafted payloads to endpoints or queues that perform normalization during request processing or job execution.
5. Repeat or parallelize requests to increase CPU consumption, cause worker saturation, and produce latency or timeout-based denial of service.

How to detect it

Because this issue causes denial of service rather than code execution, investigation should focus on performance anomalies correlated with unusual Unicode-heavy inputs. Review web server, API gateway, application, APM, worker, and queue logs for sudden CPU saturation, request timeouts, long request durations, worker restarts, or backlog growth tied to endpoints that accept arbitrary text. Inspect captured request bodies where legally and operationally appropriate for unusually long sequences of Unicode combining marks, especially repeated characters in the U+0300-U+036F, U+1AB0-U+1AFF, U+1DC0-U+1DFF, U+20D0-U+20FF, and U+FE20-U+FE2F ranges. Search code and dependency telemetry for hot paths involving unicodedata.normalize(). In Python runtime logs and profiling data, look for excessive time spent in unicodedata.normalize, text canonicalization, validation, search preprocessing, or slug/identifier generation immediately before latency spikes or worker termination. There are no public named threat actors, KEV activity, ransomware usage, or mature exploit reports associated with the input data, so detections should emphasize behavioral signs of CPU-exhaustion attempts rather than fixed malware indicators.

• unicodedata.normalize
• NFC
• NFD
• NFKC
• NFKD
• \u0300
• \u0301
• \u0302
• \u0303
• \u0304
• \u0305
• \u0306
• \u0307
• \u0308
• \u0309
• \u030A
• \u030B
• \u030C
• \u030D
• \u030E
• \u030F
• \u0310
• \u0311
• \u0312
• \u0313
• \u0314
• \u0315
• \u0316
• \u0317
• \u0318
• \u0319
• \u031A
• \u031B
• \u031C
• \u031D
• \u031E
• \u031F
• TimeoutError
• request timed out
• worker timeout
• CPU time limit exceeded

What your security team should do

• Inventory Python applications and services that process untrusted Unicode text and identify direct or indirect uses of unicodedata.normalize().
• Prioritize internet-facing, unauthenticated, high-volume, or latency-sensitive services for review and mitigation, even though current EPSS and KEV signals are low.
• Apply vendor-provided Python/runtime updates as soon as fixed versions are available for the deployed distributions and base images.
• Implement pre-normalization input limits, combining-character run limits, rate limiting, and request/job timeouts on exposed text-submission paths.
• Add performance monitoring and alerting for abnormal CPU spikes, increased request latency, worker exhaustion, and repeated timeout errors associated with text-heavy endpoints.
• Review WAF/API gateway controls for maximum request body sizes and abuse throttling on endpoints accepting arbitrary text.
• Run regression tests to ensure legitimate internationalized input is still accepted while pathological combining-mark sequences are bounded or rejected.