Input Validation Flaw in the stringprep Module of Python
CVE-2026-17084

6MEDIUM

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
18 August 2026

What is CVE-2026-17084?

The stringprep module in Python exhibits a vulnerability due to incorrect processing of characters based on outdated Unicode standards. Specifically, it fails to accurately handle characters specified in RFC 3454 tables B.2 and B.3. This discrepancy leads to mismatches in domain name processing when utilizing IDNA 2003 protocols, impacting domains that include characters with updated Unicode attributes or those not previously registered. As a result, this vulnerability poses a significant risk to applications relying on accurate domain name validation.

Affected Version(s)

CPython 0 < 3.16.0

References

https://github.com/python/cpython/pull/155293
patch
https://github.com/python/cpython/issues/155292
issue-tracking
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bitshift (https://github.com/TheShiftedBit)
Seth Larson (https://github.com/sethmlarson)
Stan Ulbrych (https://github.com/StanFromIreland)
Marc-Andre Lemburg (https://github.com/malemburg)
Petr Viktorin (https://github.com/encukou)
.