{"id":"CVE-2026-17084","title":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0","summary":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processin…","severity":"medium","cvss":6,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-436","CWE-439"],"vendor":"Python Software Foundation","product":"CPython","affected":["CPython < 3.15.0rc2"],"patched":["hardened_images"],"published":"2026-08-18","updated":"2026-09-10","sourceUpdated":"2026-09-10T01:16:35.477","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","references":[{"url":"https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","label":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/155292","label":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/155293","label":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","label":"cna@python.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/18/2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-17084.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-17084"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517897"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-17084"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084"},{"url":"https://access.redhat.com/errata/RHSA-2026:65513"},{"url":"https://access.redhat.com/errata/RHSA-2026:65525"},{"url":"https://access.redhat.com/errata/RHSA-2026:65531"},{"url":"https://access.redhat.com/errata/RHSA-2026:65567"},{"url":"https://access.redhat.com/errata/RHSA-2026:65505"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-18T16:03:21.438212Z"},"cvssSource":"cna","epss":0.00721,"epssPercentile":0.519,"scores":{"cna":6,"vendor":6.5},"ingestedAt":"2026-09-05T18:43:14.621Z","slug":"CVE-2026-17084","body":"## Overview\n\nThe \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-17084.json)\n- **RHSA-2026:65513** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65513)\n- **RHSA-2026:65525** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65525)\n- **RHSA-2026:65531** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65531)\n- **RHSA-2026:65567** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65567)\n- **RHSA-2026:65505** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65505)","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":33,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8347,"id":"CVE-2026-17084","ts":1788920416649,"field":"cvss","old":"6.5","new":"6"},{"seq":4973,"id":"CVE-2026-17084","ts":1788887222279,"field":"cvss","old":null,"new":"6.5"},{"seq":4972,"id":"CVE-2026-17084","ts":1788887222279,"field":"severity","old":"none","new":"medium"},{"seq":3856,"id":"CVE-2026-17084","ts":1788886354862,"field":"cvss","old":"6.5","new":null},{"seq":3855,"id":"CVE-2026-17084","ts":1788886354862,"field":"severity","old":"medium","new":"none"},{"seq":3185,"id":"CVE-2026-17084","ts":1788883133357,"field":"cvss","old":null,"new":"6.5"},{"seq":3184,"id":"CVE-2026-17084","ts":1788883133357,"field":"severity","old":"none","new":"medium"}]}