Description (CNA)
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Python Software Foundation / CPython | affected 0 before 3.10.21; affected 3.11.0 before 3.11.16; affected 3.12.0 before 3.12.14; affected 3.13.0 before 3.13.14; affected 3.14.0 before 3.14.6; affected 3.15.0a1 before 3.15.0b2 |
CWE
CWE-407
References
- https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/
- https://github.com/python/cpython/pull/149080
- https://github.com/python/cpython/issues/149079
- https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0
- https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f
- https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32
- https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066
- https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598
- https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f
- https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc
- https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.