CVE-2026-17084: Unicode Stringprep Information Disclosure

CVE-2026-17084 Overview

CVE-2026-17084 is a data handling vulnerability in the Python stringprep module. The module failed to process characters from RFC 3454 tables B.2 and B.3 correctly. Instead of using the specified Unicode 3.2.0 codepoint attributes, it used the latest Unicode codepoint attributes at build time. This mismatch affects domain names processed through IDNA 2003 (the idna codec) and the in_table_b2() function of the stringprep module. The issue is classified under [CWE-436] Interpretation Conflict. Only domain names containing characters registered after Unicode 3.2.0, or whose case-folding attributes changed since then, are affected.

Critical Impact
The flaw enables domain name mapping mismatches that can lead to integrity violations when applications rely on stringprep normalization for IDNA 2003 processing.

Affected Products

CPython stringprep module
CPython encodings.idna codec (IDNA 2003)
Applications relying on stringprep.in_table_b2() for domain normalization

Discovery Timeline

2026-08-18 - CVE CVE-2026-17084 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-17084

Vulnerability Analysis

RFC 3454 (stringprep) defines preparation rules for internationalized strings using specific Unicode 3.2.0 codepoint tables. Python's stringprep module generates its lookup tables from the current Unicode database available at build time rather than pinning to Unicode 3.2.0. Tables B.2 and B.3 govern case-folding mappings used by IDNA 2003 during domain name normalization. When newer Unicode versions redefine case-folding behavior for a codepoint, or add codepoints that were unassigned in Unicode 3.2.0, Python produces mappings that diverge from the RFC specification. This creates an interpretation conflict between Python's IDNA 2003 implementation and RFC-compliant implementations in other systems.

Root Cause

The root cause resides in Tools/unicode/makeunicodedata.py, which generates the stringprep tables from the Unicode database bundled with the CPython build. The generator did not restrict codepoint attribute lookups to the Unicode 3.2.0 dataset required by RFC 3454. Any codepoint added or modified in Unicode after version 3.2.0 propagated incorrect attributes into the compiled stringprep tables.

Attack Vector

An attacker who controls or supplies a specially crafted internationalized domain name can trigger inconsistent normalization between Python and RFC-compliant peers. This may enable domain spoofing, cache confusion, or access control bypass when different components in a pipeline resolve the same input to different canonical forms. Exploitation is passive and depends on user interaction with the affected input path.

python

# Patch context in Tools/unicode/makeunicodedata.py

 import dataclasses
 import os
+import subprocess
 import sys
 import re
 import zipfile

Source: GitHub Commit 7e109d0

The patch modifies the table generator to fetch and process Unicode 3.2.0 data explicitly, aligning stringprep output with RFC 3454.

Detection Methods for CVE-2026-17084

Indicators of Compromise

Unexpected divergence between Python IDNA 2003 normalization output and results from other RFC-compliant libraries for the same input domain.
Application logs recording UnicodeError or UnicodeDecodeError exceptions from the encodings.idna codec when handling internationalized domains.
Domain names containing codepoints added or modified in Unicode versions after 3.2.0 appearing in authentication, TLS, or email routing contexts.

Detection Strategies

Audit code paths that call stringprep.in_table_b2(), encodings.idna.ToASCII, or encodings.idna.nameprep and compare outputs against a reference implementation.
Run differential testing between the patched and unpatched Python builds using a corpus of internationalized domain names.
Scan software bill of materials (SBOM) records for CPython versions predating the fix committed in GitHub Pull Request #155293.

Monitoring Recommendations

Enable structured logging on domain parsing and TLS certificate validation code paths that accept user-supplied hostnames.
Alert on IDNA normalization mismatches between application tiers, gateways, and downstream resolvers.
Track upstream CPython security advisories via the Python Security Announce Thread.

How to Mitigate CVE-2026-17084

Immediate Actions Required

Inventory all CPython interpreters and third-party applications that depend on the stringprep module or the encodings.idna codec.
Apply the upstream CPython patches referenced in GitHub Commit 5181304b and GitHub Commit 7e109d0.
Rebuild any bundled or vendored CPython distributions so the regenerated stringprep tables use Unicode 3.2.0 attributes.

Patch Information

The fix is tracked under GitHub Issue #155292 and merged through GitHub Pull Request #155293. The patch pins the Tools/unicode/makeunicodedata.py generator to Unicode 3.2.0 codepoint attributes when producing stringprep tables B.2 and B.3. Downstream distributors should rebuild CPython artifacts to inherit the corrected tables. Cross-reference the Openwall OSS-Security Post for coordination details.

Workarounds

Prefer IDNA 2008 processing via the third-party idna package for hostname normalization until CPython is patched.
Validate internationalized domain names against an RFC-compliant external service before passing them to Python's encodings.idna codec.
Reject inputs containing codepoints not defined in Unicode 3.2.0 when strict RFC 3454 semantics are required.

bash

# Verify installed Python version and stringprep behavior
python3 -c "import stringprep, unicodedata; print(unicodedata.unidata_version)"
python3 -c "import encodings.idna; print(encodings.idna.ToASCII('example.test'))"