---
id: CVE-2026-17084
title: |-
  The "stringprep" module didn't process characters from RFC 3454 tables 
  B.2 or B.3 correctly: the latest Unicode codepoint attributes were used 
  instead of the specified Unicode 3.2.0
summary: |-
  The "stringprep" module didn't process characters from RFC 3454 tables 
  B.2 or B.3 correctly: the latest Unicode codepoint attributes were used 
  instead of the specified Unicode 3.2.0. This behavior would cause 
  mismatches when processin…
severity: medium
cvss: 6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-436
  - CWE-439
vendor: Python Software Foundation
product: CPython
affected:
  - CPython < 3.15.0rc2
patched:
  - hardened_images
published: '2026-08-18'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T01:16:35.477'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-17084'
references:
  - url: >-
      https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784
    label: cna@python.org
  - url: 'https://github.com/python/cpython/issues/155292'
    label: cna@python.org
  - url: 'https://github.com/python/cpython/pull/155293'
    label: cna@python.org
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/
    label: cna@python.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/08/18/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-17084.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-17084'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2517897'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-17084'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-17084'
  - url: 'https://access.redhat.com/errata/RHSA-2026:65513'
  - url: 'https://access.redhat.com/errata/RHSA-2026:65525'
  - url: 'https://access.redhat.com/errata/RHSA-2026:65531'
  - url: 'https://access.redhat.com/errata/RHSA-2026:65567'
  - url: 'https://access.redhat.com/errata/RHSA-2026:65505'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-18T16:03:21.438212Z'
cvssSource: cna
epss: 0.00721
epssPercentile: 0.51966
scores:
  cna: 6
  vendor: 6.5
ingestedAt: '2026-09-05T18:43:14.621Z'
---

## Overview

The "stringprep" module didn't process characters from RFC 3454 tables 
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used 
instead of the specified Unicode 3.2.0. This behavior would cause 
mismatches when processing domain names using IDNA 2003 (the "idna" 
codec) and the in_table_b2() function of the "stringprep" module. This 
only affects domain names containing characters that were not previously
 registered or had their Unicode attributes such as case-folding 
behavior updated since Unicode 3.2.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-17084.json)
- **RHSA-2026:65513** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65513)
- **RHSA-2026:65525** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65525)
- **RHSA-2026:65531** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65531)
- **RHSA-2026:65567** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65567)
- **RHSA-2026:65505** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65505)