---
cve: "CVE-2026-17084"
severity: "MEDIUM"
cvss: 6.0
epss: "51%"
vendor: "Python Software Foundation"
kev: false
exploited: false
published: "2026-08-18 14:16:56"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-06T04:54:17+02:00"
---

# CVE-2026-17084

> 6.0 MEDIUM · 🧪 PoC

## Beschreibung

The "stringprep" module didn't process characters from RFC 3454 tables 
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used 
instead of the specified Unicode 3.2.0. This behavior would cause 
mismatches when processing domain names using IDNA 2003 (the "idna" 
codec) and the in_table_b2() function of the "stringprep" module. This 
only affects domain names containing characters that were not previously
 registered or had their Unicode attributes such as case-folding 
behavior updated since Unicode 3.2.0.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |

## Patch verfügbar (OSV)

- 5181304bcec9cfc3c15311741c9154cdff2e3fd7 (Commit)
- 7e109d084d55e7eb25837a5f3b47ef9beee547bc (Commit)

## Referenzen

- <https://github.com/python/cpython/pull/155293>
- <https://github.com/python/cpython/issues/155292>
- <https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/>
- <https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc>
- <https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7>
- <https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae>
- <http://www.openwall.com/lists/oss-security/2026/08/18/2>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-17084) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_