CVE-2026-17084Disclosure

LOWCVSS 6.0 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-436

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 2d ago at 1 mentions (2026-08-26); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets2 URLs

By indicator

Full discourse3 posts

🤖 AI × IT × 人生｜🌏海外パパ@LifeIsMeeee45d
Disclosure
🐍 「小文字にするだけ」の関数が、 CVE番号を持つ脆弱性になった 📌 国際化ドメイン名(IDN)を扱う Pythonの仕組みの中で、 `str.lower()`が思わぬ穴を作っていた 🔤 IDN変換の規格(RFC 3454)は古いUnicode 3.2.0を前提にしている ⚠️ なのに実装はPython本体が持つ最新版Unicodeのデータで小文字変換をしてしまっていた 🔀 同じ文字列でもPythonのバージョンで変換結果が食い違い、ドメイン名の照合をすり抜けかねない状態だった（CVE-2026-17084） 🤔 「小文字にするだけ」の処理が Unicodeのバージョン次第で結果が変わるなんて、言われるまで気づかない類の穴。地味だけど地味に怖い。 #Python #セキュリティ
Post summary
CVE‑2026‑17084 discloses a flaw in Python’s IDN handling where str.lower() uses an outdated Unicode spec, causing inconsistent domain‑name normalization across Python versions.
0000040
51 followersView on X
dream.more@dali133146d
Disclosure
Python 內置的 str.lower 函數因使用現代 Unicode 版本（17.0）而非 RFC 3454 指定的 3.2.0 標準，導致 IDNA 域名編碼不一致。影響估計挺大的，翻了一下自己的項目也用了很多這個函數。 https://byteiota.com/python-str-lower-security-vulnerability-cve-2026-17084/ https://t.co/doeZsdEOUK
Post summary
The post discusses a denial-of-service‐type vulnerability in Python’s str.lower due to Unicode version mismatch, potentially affecting IDNA domain handling, but no PoC, exploit, or patch details are provided.
0000046
116 followersView on X
foursignals@foursignalsdev46d
Disclosure
Python's `str.lower()` in IDNA 2003 encoding mismatches Unicode versions, creating CVE-2026-17084 bypass risk. Audit `str.encode('idna')` usage now. https://www.foursignals.dev/wire/2026-08-26/when-str-lower-is-a-security-vulnerability-in-python-788dfb
Post summary
The post announces CVE‑2026‑17084, a mismatch in Python's IDNA 2003 handling that permits a bypass, and advises users to audit str.encode('idna') usage.
0000033
43 followersView on X

Explore more

Back to dashboard