MediumFix available
python3.11, python3.13 and 1 more products — security advisory
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
- Products
- python3.11, python3.13, python3.14
- Affected versions
- 3.11.2-6, 3.11.2-6+deb12u1, 3.11.2-6+deb12u2, 3.11.2-6+deb12u3, 3.11.2-6+deb12u4, 3.11.2-6+deb12u5, 3.11.2-6+deb12u6, 3.11.2-6+deb12u7, 3.11.2-6+deb12u8, 3.13.11-1, 3.13.12-1, 3.13.5-2, 3.13.5-2+deb13u1, 3.13.5-2+deb13u2, 3.13.6-1, 3.13.7-1, 3.13.8-1, 3.13.9-1, 3.14.0-1, 3.14.0-2, 3.14.0-3, 3.14.0-4, 3.14.0-5, 3.14.0~a7-1, 3.14.0~b1-1, 3.14.0~b2-1, 3.14.0~b3-1, 3.14.0~b4-1, 3.14.0~rc1-1, 3.14.0~rc2-1, 3.14.0~rc3-1, 3.14.2-1, 3.14.3-1, 3.14.3-2, 3.14.3-3, 3.14.3-4, 3.14.3-5, 3.14.4-1, 3.14.4-2, 3.14.5-1, 3.14.5~rc1-1
- Fixed versions
- 3.11.2-6+deb12u9, 3.13.14-1, 3.13.5-2+deb13u3, 3.14.6-1
- CVEs
- CVE-2026-3276
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:02 UTC · Revision 1
Source evidence
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
osv:DEBIAN-CVE-2026-3276
python3.11
Fixed versions: 3.11.2-6+deb12u9
python3.13
Fixed versions: 3.13.5-2+deb13u3
python3.13
Fixed versions: 3.13.14-1
python3.14
Fixed versions: 3.14.6-1
Complete source record
{
"id": "0b5fcb6c1773e82793bc2bbab81410a1dd3d6a4172124cae5de290a5f72b5fd8",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-3276",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-3276",
"summary": "unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.",
"evidence": "osv:DEBIAN-CVE-2026-3276",
"products": [
{
"name": {
"value": "python3.11",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.11.2-6+deb12u9",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "3.11.2-6",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u3",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u4",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u5",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u6",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u7",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u8",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python3.13",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.13.5-2+deb13u3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "3.13.5-2",
"evidence": "/affected/1/versions"
},
{
"value": "3.13.5-2+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "3.13.5-2+deb13u2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python3.13",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.13.14-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.13.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.12-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.5-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.6-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.7-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.8-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.9-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "python3.14",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.14.6-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "3.14.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-3",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-4",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-5",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~a7-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b1-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b4-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc1-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-3",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-4",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-5",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.4-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.4-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.5-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.5~rc1-1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2026-3276",
"aliases": [
"DEBIAN-CVE-2026-3276"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.11.2-6+deb12u9"
}
]
}
],
"package": {
"name": "python3.11",
"purl": "pkg:deb/debian/python3.11?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.11.2-6",
"3.11.2-6+deb12u1",
"3.11.2-6+deb12u2",
"3.11.2-6+deb12u3",
"3.11.2-6+deb12u4",
"3.11.2-6+deb12u5",
"3.11.2-6+deb12u6",
"3.11.2-6+deb12u7",
"3.11.2-6+deb12u8"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3276.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.5-2+deb13u3"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.13.5-2",
"3.13.5-2+deb13u1",
"3.13.5-2+deb13u2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3276.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.14-1"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.13.11-1",
"3.13.12-1",
"3.13.5-2",
"3.13.6-1",
"3.13.7-1",
"3.13.8-1",
"3.13.9-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3276.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.6-1"
}
]
}
],
"package": {
"name": "python3.14",
"purl": "pkg:deb/debian/python3.14?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.14.0-1",
"3.14.0-2",
"3.14.0-3",
"3.14.0-4",
"3.14.0-5",
"3.14.0~a7-1",
"3.14.0~b1-1",
"3.14.0~b2-1",
"3.14.0~b3-1",
"3.14.0~b4-1",
"3.14.0~rc1-1",
"3.14.0~rc2-1",
"3.14.0~rc3-1",
"3.14.2-1",
"3.14.3-1",
"3.14.3-2",
"3.14.3-3",
"3.14.3-4",
"3.14.3-5",
"3.14.4-1",
"3.14.4-2",
"3.14.5-1",
"3.14.5~rc1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3276.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-08T09:00:08.000724404Z",
"provider": "osv",
"upstream": [
"CVE-2026-3276"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-3276"
]
},
"related_cves": [
{
"value": "CVE-2026-3276",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 98825,
"published_at": "2026-06-03T16:16:29.253+00:00"
}