CVE-2026-17084: 
Python Interpreter vulnerability analysis and mitigation

CVE-2026-17084 is a Medium severity vulnerability in CPython's stringprep module affecting all versions before 3.15.0 (with backports also targeting 3.10–3.14). The flaw causes the StringPrep algorithm to use current Unicode codepoint attributes instead of the Unicode 3.2.0 attributes mandated by RFC 3454, leading to interpretation conflicts when processing internationalized domain names via IDNA 2003. It was discovered by Seth Larson and reported on August 6, 2026, with public disclosure on August 18, 2026. The CVSS v4.0 base score is 6.0 (Medium) (oss-security, CPython PR).

The root cause is an interpretation conflict (CWE-436) in Lib/stringprep.py and the encodings.idna codec, where makeunicodedata.py and mkstringprep.py were not constrained to Unicode 3.2.0 attribute data as required by RFC 3454. As a result, characters added or modified in Unicode versions after 3.2.0 — such as those with updated case-folding behavior — were processed using their modern attributes rather than the RFC-mandated ones. This causes mismatches in the in_table_b2() function and the idna codec when encoding domain names containing such characters (e.g., Cherokee Letter A, Georgian Capital Letter AN, Cyrillic Letter Palochka). Exploitation requires a network-accessible application that processes attacker-influenced internationalized domain names, and passive user interaction is a precondition (CPython Issue, CPython PR).

Successful exploitation can cause domain name resolution mismatches, potentially allowing an attacker to register a domain name that Python's IDNA 2003 processing normalizes to a different (legitimate) domain, enabling homograph-style attacks or bypassing domain-based security controls. The primary impact is on integrity — specifically, the incorrect encoding or validation of internationalized domain names — with no direct confidentiality or availability impact. Applications relying on Python's stringprep or idna codec for domain validation, authentication, or access control decisions are most at risk (oss-security, CPython Issue).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution for this vulnerability. The EPSS score is 0.0, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable, reflecting the narrow scope — only domain names with characters whose Unicode attributes changed after version 3.2.0 are affected (oss-security).

The Python Software Foundation has merged a fix into CPython main (commit 7e109d0) and backported it to the 3.15 branch (PR #156017) and 3.14 branch (PR #156020); backports to 3.10–3.13 are also labeled for security fixes. Users should upgrade to a patched release once available for their branch. As a workaround, applications that perform domain name validation should avoid relying solely on Python's built-in idna codec for security-sensitive decisions and consider using a third-party IDNA library (e.g., idna PyPI package) that correctly implements IDNA 2003 with Unicode 3.2.0 constraints (CPython PR, oss-security).

Seth Larson (Python Security Developer-in-Residence) authored the fix and published a blog post titled "When str.lower() is a security vulnerability," drawing community attention to the subtle nature of Unicode normalization bugs in security contexts (sethmlarson.dev). The disclosure was forwarded to the oss-security mailing list by Alan Coopersmith of Oracle, indicating broad awareness in the open source security community (oss-security). Community reaction on Bluesky and security aggregators noted the nuanced, hard-to-detect nature of the vulnerability.