Technology
Python addresses CVE-2026-17084 security flaw in IDNA 2003 handling
A bug in Python's legacy StringPrep and IDNA implementations caused string lowercasing to diverge from the required Unicode 3.2.0 standard.
The short version
- A security flaw tracked as CVE-2026-17084 was identified in Python's implementation of the obsolete IDNA 2003 standard and StringPrep module.
- The vulnerability occurred because calling str.lower() used the Python interpreter's current Unicode data version instead of enforcing Unicode 3.2.0 rules required by RFC 3454.
- Developers resolved the issue by creating specific exceptions to align str.lower() output with Unicode 3.2.0 specifications for affected functions.
- Developers are generally advised to use the external idna package for IDNA 2008 standards rather than Python's built-in legacy IDNA 2003 encoder.
Key facts
- The vulnerability CVE-2026-17084 stems from Python's stringprep module and idna codec using the interpreter's default Unicode data version via str.lower() rather than Unicode 3.2.0 as mandated by RFC 3454.[Hacker News]
- The security vulnerability was reported by Bitshift.[Hacker News]
- The remediation was co-developed by Seth Larson and Stan Ulbrych, and reviewed by Marc-Andre Lemburg and Petr Viktorin.[Hacker News]
- The fix mapped codepoint exceptions where modern str.lower() behavior differed from Unicode 3.2.0 to ensure compliance with the IDNA 2003 specification.[Hacker News]