CVE-2026-17084: stringprep.map_table_b2() deviates from RFC 3454 Table B.2 — breaks IDNA interoperability
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the intableb2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
Affected Software
Event History
Frequently Asked Questions
Which uses of the stringprep module are affected?
The issue is limited to IDNA 2003 processing through Python's "idna" codec and to callers of stringprep.in_table_b2(). It affects only domain names containing code points that were unassigned in Unicode 3.2.0 or whose attributes, including case-folding behavior, changed after Unicode 3.2.0.
What input is needed to trigger the interoperability mismatch?
An attacker or triggering input would need to supply or cause processing of an IDNA 2003 domain name containing one of the affected Unicode characters. Domain names composed only of characters whose Unicode 3.2.0 attributes remain unchanged are not affected.
How can I determine whether my application is exposed?
Look for applications that process internationalized domain names with the "idna" codec or directly call stringprep.in_table_b2(), then identify whether they accept domain names containing code points with post-Unicode-3.2.0 registration or attribute changes. The reported effect is a mismatch in IDNA 2003 domain-name processing.