Stringprep Domain Name Processing Flaw with IDNA 2003

Executive Summary

CVE-2026-17084 is a vulnerability in Python's stringprep module where it incorrectly processed Unicode characters from RFC 3454 tables B.2 or B.3. Instead of using the specified Unicode 3.2.0 attributes, it used the latest Unicode codepoint attributes. This caused mismatches when handling domain names with IDNA 2003 and the in_table_b2() function.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects Python's stringprep and IDNA 2003 modules. To detect it, check if your Python version (3.10 to 3.16) is affected by running: python -c "import sys; print(sys.version)" and comparing with patched versions. Look for domain names processed by IDNA 2003 that may contain unusual Unicode characters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to exploit domain name mismatches, potentially leading to phishing attacks or unauthorized access. Systems using Python's stringprep or IDNA 2003 for domain processing may misinterpret domain names, causing security failures or incorrect validations.

Useful 0 Not Useful 0

Mitigation Strategies

Update Python to a patched version (3.10.15+, 3.11.10+, 3.12.5+, 3.13.0+, or 3.14.0+). If updating is not possible, restrict domain name processing to trusted sources and avoid IDNA 2003 for new implementations.

Useful 0 Not Useful 0