Bug 2517897 (CVE-2026-17084) - CVE-2026-17084 python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability
Summary: CVE-2026-17084 python: Python stringprep module: Incorrect domain name proces...
Keywords:
Status: NEW
Alias: CVE-2026-17084
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-18 14:02 UTC by OSIDB Bzimport
Modified: 2026-09-08 07:48 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-18 14:02:12 UTC 
The "stringprep" module didn't process characters from RFC 3454 tables 
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used 
instead of the specified Unicode 3.2.0. This behavior would cause 
mismatches when processing domain names using IDNA 2003 (the "idna" 
codec) and the in_table_b2() function of the "stringprep" module. This 
only affects domain names containing characters that were not previously
 registered or had their Unicode attributes such as case-folding 
behavior updated since Unicode 3.2.0.
Note You need to log in before you can comment on or make changes to this bug.