Vulnerability · Published Aug 18, 2026 · Assigned by PSF
CVE-2026-17084stringprep.map_table_b2() deviates from RFC 3454 Table B.2
Medium 6.0
In plain English
A medium-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | python3 | 3.12.15-r0 | ALPINE-CVE-2026-17084 |
| Alpine:v3.22 | python3 | 3.12.15-r0 | ALPINE-CVE-2026-17084 |
| Alpine:v3.23 | python3 | 3.12.15-r0 | ALPINE-CVE-2026-17084 |
| Alpine:v3.24 | python3 | 3.14.8-r0 | ALPINE-CVE-2026-17084 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2026-17084 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-17084 |
| Debian:14 | pypy3 | 8.0.1+dfsg-1 | DEBIAN-CVE-2026-17084 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u9 | DEBIAN-CVE-2026-17084 |
| Debian:13 | python3.13 | no fix listed | DEBIAN-CVE-2026-17084 |
| Debian:14 | python3.14 | 3.14.7-3 | DEBIAN-CVE-2026-17084 |
| Debian:14 | python3.15 | 3.15.0~rc2-1 | DEBIAN-CVE-2026-17084 |
| Ubuntu:22.04:LTS | python3.10 | no fix listed | UBUNTU-CVE-2026-17084 |
| Ubuntu:24.04:LTS | python3.12 | no fix listed | UBUNTU-CVE-2026-17084 |
| Ubuntu:26.04:LTS | python3.14 | no fix listed | UBUNTU-CVE-2026-17084 |
| Ubuntu:26.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-17084 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.223.11.0 – before 3.11.173.12.0 – before 3.12.153.13.0 – before 3.13.163.14.0 – before 3.14.83.15.0a1 – before 3.15.0rc2 |
Weakness: CWE-436 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/pull/155293 patch
- https://github.com/python/cpython/issues/155292 issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/ vendor-advisory
- https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc patch
- https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7 patch
- https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae patch
- https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214 patch
- https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296 patch
- https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784 patch
- https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296 patch
- https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72 patch
- http://www.openwall.com/lists/oss-security/2026/08/18/2