Description
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Python Software Foundation CPython
Default version status: unaffected
0 to < 3.10.21affected3.11.0 to < 3.11.16affected3.12.0 to < 3.12.14affected3.13.0 to < 3.13.14affected3.14.0 to < 3.14.6affected3.15.0a1 to < 3.15.0b2affected
References
- https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/ ↗
- https://github.com/python/cpython/pull/149080 ↗
- https://github.com/python/cpython/issues/149079 ↗
- https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0 ↗
- https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f ↗
- https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32 ↗
- https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066 ↗
- https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598 ↗
- https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f ↗
- https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc ↗
- https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c ↗
- http://www.openwall.com/lists/oss-security/2026/06/03/15 ↗