CVE-2026-17084
published 2026-08-18CVE-2026-17084: The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the…
PriorityP431medium6CVSS 4.0
AVNACLATPPRNUIPVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.73%
53.9th percentile
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| python_software_foundation | cpython | < 3.10.22 | 3.10.22 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.17 | 3.11.17 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.15 | 3.12.15 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.16 | 3.13.16 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.8 | 3.14.8 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0rc2 | 3.15.0rc2 |
CVSS provenance
nvdv4.06.0MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Python up to 3.15.x stringprep in_table_b2 interpretation conflict (WID-SEC-2026-2924)
vuldb·2026-09-06·CVSS 6.0
CVE-2026-17084 [MEDIUM] Python up to 3.15.x stringprep in_table_b2 interpretation conflict (WID-SEC-2026-2924)
A vulnerability labeled as critical has been found in Python up to 3.15.x. This affects the function in_table_b2 of the component stringprep. Such manipulation leads to interpretation conflict.
This vulnerability is documented as CVE-2026-17084. The attack can be executed remotely. There is not any exploit available.
The affected component should be upgraded.
GHSA
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0.
ghsa_unreviewed·2026-08-18
CVE-2026-17084 [MEDIUM] CWE-436 The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0.
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
Red Hat
python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability
vendor_redhat·2026-08-18·CVSS 6.0
CVE-2026-17084 [MEDIUM] CWE-439 python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability
python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
A flaw was found in the Python 'stringprep' module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 stan
No detection rules found.
No public exploits indexed.
https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6baehttps://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bchttps://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72https://github.com/python/cpython/issues/155292https://github.com/python/cpython/pull/155293https://mail.python.org/archives/list/[email protected]/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/http://www.openwall.com/lists/oss-security/2026/08/18/2
2026-08-18
Published