CVE-2026-17084
Full vulnerability record from the local CVENow database.
Description
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
Severity
MEDIUM
CVSS score
6.0
(v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-18 14:16:56.290000
Last modified
2026-10-22 22:10:00.250000
View original CVE JSON
{
"id": "CVE-2026-17084",
"sourceIdentifier": "[email protected]",
"published": "2026-08-18T14:16:56.290",
"lastModified": "2026-10-22T22:10:00.250",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."
},
{
"lang": "es",
"value": "El módulo ’stringprep’ no procesó correctamente los caracteres de las tablas B.2 o B.3 de RFC 3454: se utilizaron los atributos de punto de código Unicode más recientes en lugar de los especificados en Unicode 3.2.0. Este comportamiento causaría desajustes al procesar nombres de dominio usando IDNA 2003 (el códec ’idna’) y la función in_table_b2() del módulo ’stringprep’. Esto solo afecta a los nombres de dominio que contienen caracteres que no estaban registrados previamente o que tuvieron sus atributos Unicode, como el comportamiento de plegado de mayúsculas y minúsculas (case-folding), actualizados desde Unicode 3.2.0."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Python Software Foundation",
"product": "CPython",
"defaultStatus": "unaffected",
"modules": [
"stringprep",
"idna"
],
"repo": "https://github.com/python/cpython",
"versions": [
{
"version": "0",
"lessThan": "3.10.22",
"versionType": "python",
"status": "affected"
},
{
"version": "3.11.0",
"lessThan": "3.11.17",
"versionType": "python",
"status": "affected"
},
{
"version": "3.12.0",
"lessThan": "3.12.15",
"versionType": "python",
"status": "affected"
},
{
"version": "3.13.0",
"lessThan": "3.13.16",
"versionType": "python",
"status": "affected"
},
{
"version": "3.14.0",
"lessThan": "3.14.8",
"versionType": "python",
"status": "affected"
},
{
"version": "3.15.0a1",
"lessThan": "3.15.0rc2",
"versionType": "python",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-18T16:03:21.438212Z",
"id": "CVE-2026-17084",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-436"
}
]
}
],
"references": [
{
"url": "https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/issues/155292",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/pull/155293",
"source": "[email protected]"
},
{
"url": "https://mail.python.org/archives/list/[email protected]/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/",
"source": "[email protected]"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/18/2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}