Skip to main content

CPython stringprep CVE-2026-17084

| EUVDEUVD-2026-60889 MEDIUM
Interpretation Conflict (CWE-436)
2026-08-18 PSF GHSA-w246-x8qv-r8f5
Information Disclosure Cpython Suse
6.0
CVSS 4.0 · Vendor: PSF
Share

Severity by source

Vendor (PSF) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

AC:H reflects the narrow precondition of IDN chars with changed Unicode properties since 3.2.0; UI:R because an application must process a crafted domain; I:H for domain identity confusion enabling bypass; C:N and A:N because no data is disclosed and no availability disruption occurs.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 18, 2026 - 14:31 vuln.today
Analysis Generated
Aug 18, 2026 - 14:31 vuln.today
CVE Published
Aug 18, 2026 - 13:57 cve.org
MEDIUM 6.0

DescriptionCVE.org

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

AnalysisAI

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing internationalized domain names (IDNs) under IDNA 2003. The module incorrectly applies modern Unicode codepoint attributes - Unicode 17.0.0 in the fixed version - instead of the Unicode 3.2.0 attributes mandated by RFC 3454, causing incorrect case-folding behavior via in_table_b2() and related functions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two simultaneous conditions: the target application must use Python's built-in idna codec or call stringprep.in_table_b2() for domain name normalization or security validation, and the domain names being processed must contain Unicode characters whose case-folding or categorical properties changed between Unicode 3.2.0 and the Unicode version bundled with the installed Python runtime. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.0 with vector AV:N/AC:L/AT:P/PR:N/UI:P reflects a network-reachable flaw with high integrity impact but constrained attack requirements (AT:P) and passive user interaction (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the upstream fix from CPython PR #155293 (https://github.com/python/cpython/pull/155293) once it is merged and included in a tagged CPython release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cpython

View all
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-11972 HIGH
8.2 Jun 23

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-7774 MEDIUM
6.9 Jun 04

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

CVE-2026-19672 MEDIUM
6.3 Aug 19

CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p
CVE-2026-7210 MEDIUM
6.3 May 11

XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo
CVE-2026-3276 MEDIUM
6.3 Jun 03

Denial-of-service via quadratic algorithmic complexity in CPython's unicodedata.normalize() affects all CPython versions
CVE-2026-15806 MEDIUM
6.0 Aug 18

Credential disclosure in Python's urllib.request HTTPPasswordMgr class family enables scheme-downgrade attacks that expo

Same weakness CWE-436 – Interpretation Conflict

View all
CVE-2026-63030 CRITICAL POC
9.8
CVE-2024-24754 CRITICAL POC
9.8
CVE-2023-24813 CRITICAL POC
9.8
CVE-2019-19589 CRITICAL POC
9.8
CVE-2025-12816 HIGH POC
8.6
CVE-2026-67201 HIGH POC
7.7
CVE-2026-14643 HIGH POC
7.5
CVE-2026-6322 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

CVE-2026-17084 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy