Medium 6.0Published Aug 18, 2026

CVE-2026-17084stringprep.map_table_b2() deviates from RFC 3454 Table B.2

Updated under an hour ago (Oct 27, 2026, 4:23 PM ET)

Does this affect you?

It affects Python Software Foundation CPython. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Software Foundation CPython

Exploited in the last 30 days

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

CVSS: 6.0 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-436
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: PSF
NVD analysis: Awaiting Analysis
Record last updated: Oct 1, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Python Software Foundation CPython python_software_foundation:cpython (from the name)	before 3.10.22; from 3.11.0 before 3.11.17; from 3.12.0 before 3.12.15; from 3.13.0 before 3.13.16; from 3.14.0 before 3.14.8; from 3.15.0a1 before 3.15.0rc2	CNA record

References

References

https://github.com/python/cpython/pull/155293	patch
https://github.com/python/cpython/issues/155292	issue-tracking
https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/	vendor-advisory
https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc	patch
https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7	patch
https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae	patch
https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214	patch
https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296	patch
https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784	patch
https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296	patch
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.