CVE-2026-17084

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

• CWE-436

• https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae
• https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7
• https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc
• https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214
• https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296
• https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784
• https://github.com/python/cpython/issues/155292
• https://github.com/python/cpython/pull/155293
• https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/
• https://www.openwall.com/lists/oss-security/2026/08/18/2

Published

Aug 18, 2026

Last Modified

Sep 10, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-17078IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…5.3
• CVE-2026-17079IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote …4.3
• CVE-2026-1708The Appointment Booking Calendar — Simply Schedule Appointme…7.5
• CVE-2026-17081IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote …7.5
• CVE-2026-17082IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…8.8
• CVE-2026-17083IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…9.8
• CVE-2026-17086The ShortPixel Image Optimizer – Optimize Images, Convert We…8.8
• CVE-2026-17087The WP Travel Engine – Tour Booking Plugin – Tour Operator S…7.5
• CVE-2026-17088IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…4.3
• CVE-2026-17089The Events Manager – Calendar, Bookings, Tickets, and more! …6.1
• CVE-2026-1709A flaw was found in Keylime. The Keylime registrar, since ve…9.8
• CVE-2026-17090The Beaver Builder Page Builder – Drag and Drop Website Buil…6.4