CVE-2026-17084: Vulnerability in Python Software Foundation CPython
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
AI Analysis
Technical Summary
The vulnerability in CPython's "stringprep" module arises because it uses updated Unicode codepoint attributes rather than the fixed Unicode 3.2.0 attributes as specified by RFC 3454 tables B.2 and B.3. This discrepancy leads to incorrect processing of domain names using the IDNA 2003 "idna" codec and the in_table_b2() function, causing mismatches for domain names containing characters that were not previously registered or had their Unicode attributes updated since Unicode 3.2.0. The affected CPython versions include all versions prior to 3.12.15, versions from 3.13.0 up to but not including 3.13.16, versions from 3.14.0 up to but not including 3.14.8, and versions from 3.15.0a1 up to but not including 3.15.0rc2.
Potential Impact
This vulnerability can cause incorrect domain name processing when using the IDNA 2003 codec, potentially leading to mismatches in domain name handling. The impact is limited to domain names containing characters with Unicode attributes changed since Unicode 3.2.0. There is no indication of direct code execution or data compromise, and no known exploits are reported in the wild.
Mitigation Recommendations
No explicit patch links are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Python Software Foundation advisories for updates and apply any released patches for the affected CPython versions. Until a patch is available, cautious use of the IDNA 2003 codec with domain names containing recently updated Unicode characters is advised.
CVE-2026-17084: Vulnerability in Python Software Foundation CPython
Description
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
CVSS v4.0
Score 6.0medium
Affected software
Python Software Foundation
CPython
pkg:github/CPythonRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in CPython's "stringprep" module arises because it uses updated Unicode codepoint attributes rather than the fixed Unicode 3.2.0 attributes as specified by RFC 3454 tables B.2 and B.3. This discrepancy leads to incorrect processing of domain names using the IDNA 2003 "idna" codec and the in_table_b2() function, causing mismatches for domain names containing characters that were not previously registered or had their Unicode attributes updated since Unicode 3.2.0. The affected CPython versions include all versions prior to 3.12.15, versions from 3.13.0 up to but not including 3.13.16, versions from 3.14.0 up to but not including 3.14.8, and versions from 3.15.0a1 up to but not including 3.15.0rc2.
Potential Impact
This vulnerability can cause incorrect domain name processing when using the IDNA 2003 codec, potentially leading to mismatches in domain name handling. The impact is limited to domain names containing characters with Unicode attributes changed since Unicode 3.2.0. There is no indication of direct code execution or data compromise, and no known exploits are reported in the wild.
Mitigation Recommendations
No explicit patch links are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Python Software Foundation advisories for updates and apply any released patches for the affected CPython versions. Until a patch is available, cautious use of the IDNA 2003 codec with domain names containing recently updated Unicode characters is advised.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PSF
- Date Reserved
- 2026-07-24T14:36:15.943Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a846685c6e8be03324c8d47
Added to database: 08/18/2026, 14:04:53 UTC
Last enriched: 10/01/2026, 15:33:50 UTC
Last updated: 10/03/2026, 02:46:03 UTC
Views: 55
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.