Medium severity · published Aug 18, 2026
CVE-2026-17084
stringprep.map_table_b2() deviates from RFC 3454 Table B.2
6.0
CVSS
0.7%
EPSS
No
On KEV
Description
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.10.22; 3.11.0 before 3.11.17; 3.12.0 before 3.12.15; 3.13.0 before 3.13.16; 3.14.0 before 3.14.8; 3.15.0a1 before 3.15.0rc2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-17084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-17084
patch
https://github.com/python/cpython/pull/155293
issue-tracking
https://github.com/python/cpython/issues/155292
vendor-advisory
https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/
patch
https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc
patch
https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7
patch
https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.4
CVE-2026-82049
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
8.2
CVE-2026-11972
tarfile opened in streaming mode mishandles EOF