CVE-2026-17084

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae
https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7
https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc
https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214
https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296
https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784
https://github.com/python/cpython/issues/155292
https://github.com/python/cpython/pull/155293
https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/
http://www.openwall.com/lists/oss-security/2026/08/18/2

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-18 14:16

Updated : 2026-09-10 01:16

NVD link : CVE-2026-17084

Mitre link : CVE-2026-17084

CVE.ORG link : CVE-2026-17084

JSON object : View

Products Affected

No product.

CWE

CWE-436

Interpretation Conflict

{"id": "CVE-2026-17084", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17084", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T16:03:21.438212Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@python.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@python.org", "affectedData": [{"repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "modules": ["stringprep", "idna"], "product": "CPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.15.0rc2", "versionType": "python"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-18T14:16:56.290", "references": [{"url": "https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/issues/155292", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/pull/155293", "source": "cna@python.org"}, {"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/", "source": "cna@python.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/18/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-436"}]}], "descriptions": [{"lang": "en", "value": "The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}], "lastModified": "2026-09-10T01:16:35.477", "sourceIdentifier": "cna@python.org"}