CVE-2026-17084

{"id": "CVE-2026-17084", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17084", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T16:03:21.438212Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@python.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@python.org", "affectedData": [{"repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "modules": ["stringprep", "idna"], "product": "CPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.10.22", "versionType": "python"}, {"status": "affected", "version": "3.11.0", "lessThan": "3.11.17", "versionType": "python"}, {"status": "affected", "version": "3.12.0", "lessThan": "3.12.15", "versionType": "python"}, {"status": "affected", "version": "3.13.0", "lessThan": "3.13.16", "versionType": "python"}, {"status": "affected", "version": "3.14.0", "lessThan": "3.14.8", "versionType": "python"}, {"status": "affected", "version": "3.15.0a1", "lessThan": "3.15.0rc2", "versionType": "python"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-18T14:16:56.290", "references": [{"url": "https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/issues/155292", "source": "cna@python.org"}, {"url": "https://github.com/python/cpython/pull/155293", "source": "cna@python.org"}, {"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/", "source": "cna@python.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/18/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-436"}]}], "descriptions": [{"lang": "en", "value": "The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}, {"lang": "es", "value": "El m\u00f3dulo \u2019stringprep\u2019 no proces\u00f3 correctamente los caracteres de las tablas B.2 o B.3 de RFC 3454: se utilizaron los atributos de punto de c\u00f3digo Unicode m\u00e1s recientes en lugar de los especificados en Unicode 3.2.0. Este comportamiento causar\u00eda desajustes al procesar nombres de dominio usando IDNA 2003 (el c\u00f3dec \u2019idna\u2019) y la funci\u00f3n in_table_b2() del m\u00f3dulo \u2019stringprep\u2019. Esto solo afecta a los nombres de dominio que contienen caracteres que no estaban registrados previamente o que tuvieron sus atributos Unicode, como el comportamiento de plegado de may\u00fasculas y min\u00fasculas (case-folding), actualizados desde Unicode 3.2.0."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "cna@python.org"}