This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-3276 →

ALPINE-CVE-2026-3276

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with...

Original description

The description as published by the source.

unicodedata.normalize() can take excessive CPU time when processing
specially crafted Unicode input containing long runs of combining characters
with alternating Canonical Combining Class values.
This affects all normalization forms.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.24 python3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-r0"}]}]

References

advisory security.alpinelinux.org