The vulnerability CVE-2026-3276 involves the unicodedata.normalize() function in CPython, which can be forced to consume excessive CPU resources by processing Unicode strings crafted with long runs of combining characters that alternate Canonical Combining Class values. This behavior affects all normalization forms supported by the function. The issue is classified under CWE-407 (Use of Excessive CPU Resources). The CVSS 4.0 base score is 6.3, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability.

An attacker can cause the unicodedata.normalize() function to use excessive CPU time, potentially leading to denial of service or performance degradation in applications that rely on this function for Unicode normalization. There is no indication of data confidentiality or integrity impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is released, consider limiting or sanitizing input to the unicodedata.normalize() function to avoid processing specially crafted Unicode strings with long runs of alternating combining characters.