What is GHSA-jg6j-874m-wgjj?

GHSA-jg6j-874m-wgjj is a security advisory published by GitHub Security Advisories with Medium severity. unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode...

Which CVE IDs does GHSA-jg6j-874m-wgjj cover?

GHSA-jg6j-874m-wgjj covers the following CVE IDs: CVE-2026-3276. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-jg6j-874m-wgjjMedium

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode...

Vendor

GitHub Security Advisories

Published

June 3, 2026

Last Modified

June 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-3276 →

📋 Description

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-3276
https://github.com/python/cpython/issues/149079
https://github.com/python/cpython/pull/149080
https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ
https://github.com/advisories/GHSA-jg6j-874m-wgjj