Skip to main content

CPython stringprep CVE-2026-17084

| EUVDEUVD-2026-60889 MEDIUM
Interpretation Conflict (CWE-436)
2026-08-18 PSF GHSA-w246-x8qv-r8f5
Information Disclosure Cpython Python Software Foundation
6.0
CVSS 4.0 · Vendor: PSF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker registers IDN label with post-Unicode-3.2.0 character
  2. Delivery
    Victim Python app receives domain via network input
  3. Exploit
    idna codec invokes stringprep.in_table_b2()
  4. Execution
    Buggy modern-Unicode mapping applied instead of RFC 3454 Unicode 3.2.0 mapping
  5. Persist
    Domain normalized to unintended canonical form
  6. Impact
    Attacker domain passes domain-based validation as legitimate

Vulnerability Assessment

Weakness
CWE
CWE-436
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
Exploitation Conditions

Exploitation requires two simultaneous conditions: the target application must use Python's built-in idna codec or call stringprep.in_table_b2() for domain name normalization or security validation, and the domain names being processed must contain Unicode characters whose case-folding or categorical properties changed between Unicode 3.2.0 and the Unicode version bundled with the installed Python runtime. Domain names using only ASCII characters or characters with stable Unicode attributes since 3.2.0 are entirely unaffected. The CVSS 4.0 AT:P value confirms that this specific configuration - IDN labels with post-3.2.0 changed-property characters - is a required precondition, not a default attack surface. The PR:N metric indicates no authentication is required since domain name processing typically occurs before credential gates. Exploitation is limited to the subset of internationalised scripts (notably Greek, Cyrillic, Cherokee, and certain letterlike symbols) whose case-folding entries differ between Unicode 3.2.0 and modern Unicode, as evidenced by the extensive B.2 table changes in the PR diff.
Impact

The CVSS 4.0 score of 6.0 with vector AV:N/AC:L/AT:P/PR:N/UI:P reflects a network-reachable flaw with high integrity impact but constrained attack requirements (AT:P) and passive user interaction (UI:P). The AT:P flag is the critical limiting factor: exploitation requires domain labels containing characters whose Unicode case-folding or category properties changed after Unicode 3.2.0 - a narrow but non-trivial set covering characters from Greek, Cyrillic, Cherokee, and other scripts. The practical threat model centers on IDN homograph-style domain confusion, where a Python-based system normalizes an internationalized domain to a different canonical form than a spec-compliant IDNA 2003 implementation, creating a gap exploitable for phishing, authentication bypass, or validation evasion in systems that use the normalized form for security decisions. This is not in the CISA KEV catalog and no public exploit code exists, placing this in a monitor-and-patch posture rather than emergency response. The VI:H integrity signal is plausible but context-dependent: if the normalized domain drives access control or identity verification, impact is high; if used only for display or logging, impact is negligible. The 'Information Disclosure' tag in the source data is misleading - the CVSS confidentiality impact is N, and the primary risk is domain identity confusion rather than data leakage. Overall, organizations running Python-based email infrastructure, identity providers, certificate validation tools, or DNS tooling that process internationalized domain names should apply the patch on their normal patching cadence; the narrow affected character set prevents broad weaponization against arbitrary ASCII domains.
Exploit ScenarioDerived

An attacker registers an internationalized domain name containing a character - such as a specific Greek or Cyrillic letter - whose case-folding mapping was added or changed after Unicode 3.2.0. A Python application using the idna codec to normalize or validate this domain maps it to a different canonical string than a spec-compliant IDNA 2003 implementation would produce, causing the application to accept the attacker's domain as equivalent to a legitimate one. This enables domain-based access control bypass or allowlist evasion in Python applications that validate IDN labels before making trust decisions.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 18, 2026

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing internationalized domain names (IDNs) under IDNA 2003. The module incorrectly applies modern Unicode codepoint attributes - Unicode 17.0.0 in the fixed version - instead of the Unicode 3.2.0 attributes mandated by RFC 3454, causing incorrect case-folding behavior via in_table_b2() and related functions. Applications using Python's idna codec for domain validation or access control are at risk of domain identity confusion for a subset of IDN labels containing characters whose Unicode properties changed after Unicode 3.2.0. A vendor fix is available via CPython PR #155293; no public exploit has been identified at time of analysis.

RemediationAI

Apply the upstream fix from CPython PR #155293 (https://github.com/python/cpython/pull/155293) once it is merged and included in a tagged CPython release. The fix is confirmed in the upstream PR, but a specific patched release version has not been independently confirmed in the available data - monitor the Python Security Announce list at https://mail.python.org/archives/list/security-announce@python.org/ and the advisory thread at https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/ for an official release. As a compensating control prior to patching, applications that use IDNA normalization for security-sensitive decisions can replace calls to Python's built-in idna codec with the third-party idna package on PyPI, which implements RFC 3454 correctly against Unicode 3.2.0; note that this introduces a new dependency requiring its own patching lifecycle. Where internationalized domain names are not needed, restricting input to ASCII-only domain names eliminates the attack surface with no Unicode processing side effects.

Affected VersionsENISA

CPython 0 <3.16.0

Affected Packages

euvd cpython fix: 3.16.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

RFC 3454 (Stringprep) defines case-folding and normalization tables B.2 and B.3 anchored explicitly to Unicode 3.2.0, ensuring consistent internationalized string handling across IDNA 2003 implementations. Python's standard library module Lib/stringprep.py implements this RFC and is consumed by the built-in idna codec for domain name encoding and decoding. The PR diff at https://github.com/python/cpython/pull/155293 confirms the root cause: stringprep.py was importing from the main unicodedata module (which reflects the installed Python runtime's Unicode version, 17.0.0 at the time of the fix) instead of from unicodedata.ucd_3_2_0 (the frozen Unicode 3.2.0 snapshot bundled with CPython). As a result, characters whose case-folding mappings or categorical properties were updated between Unicode 3.2.0 and modern Unicode - including Greek, Cyrillic, Cherokee, and many letterlike symbol codepoints visible in the B.2 table diff - were processed using the wrong rules. The fix regenerates the entire hardcoded B.2 mapping table against the correct Unicode 3.2.0 baseline and adds an assertion to ensure mkstringprep.py is re-run whenever unicodedata is updated. No CWE was formally assigned; the root cause maps conceptually to incorrect version pinning of a dependency, analogous to CWE-706 (Use of Incorrectly-Resolved Name or Reference). The affected CPE is cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*, covering all CPython versions without a fixed upper bound.

Know when Cpython gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (PSF) PRIMARY 6.0 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
vuln.today AI 5.3 MEDIUM

AC:H reflects the narrow precondition of IDN chars with changed Unicode properties since 3.2.0; UI:R because an application must process a crafted domain; I:H for domain identity confusion enabling bypass; C:N and A:N because no data is disclosed and no availability disruption occurs.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat 6.5 MEDIUM

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
Passive
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

Threat Intelligence Overview

EPSS Score
0.5%
Top 59% exploitable
Prevalence
Ubiquitous
CPython is the reference Python implementation powering the vast majority of Python deployments globally.
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

51
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +30
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Cpython

View all
CVE-2026-19445 CRITICAL
9.2 Sep 30

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-11972 HIGH
8.2 Jun 23

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-19553 HIGH
7.6 Sep 30

Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-7774 MEDIUM
6.9 Jun 04

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

CVE-2026-19672 MEDIUM
6.3 Aug 19

CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p
CVE-2026-7210 MEDIUM
6.3 May 11

XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo

Same weakness CWE-436 – Interpretation Conflict

View all
CVE-2026-63030 CRITICAL POC
9.8
CVE-2024-24754 CRITICAL POC
9.8
CVE-2023-24813 CRITICAL POC
9.8
CVE-2019-19589 CRITICAL POC
9.8
CVE-2025-12816 HIGH POC
8.6
CVE-2026-67201 HIGH POC
7.7
CVE-2026-75931 HIGH POC
7.5
CVE-2026-13676 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

References

Advisories & patches
PATCH https://github.com/python/cpython/pull/155293 ADVISORY https://access.redhat.com/errata/RHSA-2026:65505 ADVISORY https://access.redhat.com/errata/RHSA-2026:65513 ADVISORY https://access.redhat.com/errata/RHSA-2026:65525 ADVISORY https://access.redhat.com/errata/RHSA-2026:65531 ADVISORY https://access.redhat.com/errata/RHSA-2026:65567 ADVISORY https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-17084 ADVISORY https://seclists.org/oss-sec/2026/q3/513 ADVISORY https://vuldb.com/vuln/391647 REF http://www.openwall.com/lists/oss-security/2026/08/18/2 REF https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae REF https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7 REF https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296 REF https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc REF https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214 REF https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296 REF https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784 REF https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72 REF https://github.com/python/cpython/issues/155292

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy