CVE-2026-17084CWE-436

CVE-2026-17084

published August 18, 2026

CVSS
6.0
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

The "stringprep" module didn't process characters from RFC 3454 tables

B.2 or B.3 correctly: the latest Unicode codepoint attributes were used

instead of the specified Unicode 3.2.0. This behavior would cause

mismatches when processing domain names using IDNA 2003 (the "idna"

codec) and the in_table_b2() function of the "stringprep" module. This

only affects domain names containing characters that were not previously

registered or had their Unicode attributes such as case-folding

behavior updated since Unicode 3.2.0.

The record
Technical detail
CVSS
6.0 · NONE
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00734 · 53.9th percentile
Weakness
CWE-436 · Interpretation Conflict
Published
2026-08-18T18:16Z
References (12)
https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae · [email protected]https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7 · [email protected]https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296 · [email protected]https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc · [email protected]https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214 · [email protected]https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296 · [email protected]https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784 · [email protected]https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72 · [email protected]https://github.com/python/cpython/issues/155292 · [email protected]https://github.com/python/cpython/pull/155293 · [email protected]https://mail.python.org/archives/list/[email protected]/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/ · [email protected]http://www.openwall.com/lists/oss-security/2026/08/18/2 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 18 AUG 13:57Z
    stringprep.map_table_b2() deviates from RFC 3454 Table B.2 — breaks IDNA interoperability
    cvelistv5