CVE-2026-3276 is a medium severity vulnerability in the Python Software Foundation's CPython implementation. The unicodedata.normalize() function can be exploited by providing Unicode input containing long runs of combining characters with alternating Canonical Combining Class values, causing the function to consume excessive CPU time. This affects all normalization forms supported by the function. The vulnerability is categorized under CWE-407, indicating a risk of excessive CPU consumption. No patch or official remediation has been indicated in the available data.

The vulnerability can cause denial of service through excessive CPU consumption when processing maliciously crafted Unicode input. This may degrade application or system performance where unicodedata.normalize() is used, potentially impacting availability. There are no indications of privilege escalation, data disclosure, or code execution from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting or validating input to unicodedata.normalize() to avoid long runs of combining characters with alternating Canonical Combining Class values if feasible.