DEBIAN-CVE-2026-3276

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2026-3276
Published: 03 Jun 2026, 16:16
Last modified:11 Jul 2026, 21:00

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
6.3 MEDIUM
4.0 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

03 Jun 2026, 16:16
Published
Vulnerability first disclosed
11 Jul 2026, 21:00
Last Modified
Vulnerability information updated

Description

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Systems

  • debian•pypy3

    all | all | all | all

  • debian•python2.7

    all

  • debian•python3.11

    all

  • debian•python3.13

    all | all | < 3.13.5-2+deb13u3 | < 3.13.14-1

  • debian•python3.14

    all | < 3.14.6-1

  • debian•python3.9

    all

References (1)