CVE catalog

CVE-2026-17084

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior w

[CVE catalog]

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Published: Aug 18, 2026, 2:16:56 PM UTC
Updated: Aug 18, 2026, 2:16:56 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.73% · Oct 22, 2026

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pypy3	sid	`8.0.1+dfsg-1`	vulnerable
Debian	pypy3	forky	`8.0.1+dfsg-1`	vulnerable
Debian	pypy3	trixie	`7.3.19+dfsg-2`	vulnerable
Debian	pypy3	bookworm	`7.3.11+dfsg-2+deb12u3`	vulnerable
Debian	python3.11	bookworm	`3.11.2-6+deb12u8`	vulnerable
Debian	python3.11	bookworm-security	`3.11.2-6+deb12u9`	fixed
Alpine	python3	3.21	`3.12.15-r0`	fixed
Alpine	python3	3.22	`3.12.15-r0`	fixed
Alpine	python3	3.23	`3.12.15-r0`	fixed
Alpine	python3	3.24	`3.14.8-r0`	fixed
Suse	python313	linux enterprise module for python 3 15 sp7	`3.13.15-150700.4.56.1`	fixed
Suse	python313-core	linux enterprise module for python 3 15 sp7	`3.13.15-150700.4.56.1`	fixed
Opensuse	python313	tumbleweed	`3.13.15-1.1`	fixed
Fedora	python3.14	43	`0:3.14.8-1.fc43`	fixed
Fedora	python3-docs	43	`0:3.14.8-1.fc43`	fixed
Fedora	python3.14	44	`0:3.14.8-1.fc44`	fixed
Fedora	python3-docs	44	`0:3.14.8-1.fc44`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pypy3	source	sid	`(unfixed)`	not yet assigned	Not reported	[1147445]
Debian	pypy3	source	forky	`(unfixed)`	not yet assigned	Not reported	[1147445]
Debian	pypy3	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1147445]
Debian	pypy3	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1147445]
Debian	python3.11	source	bookworm	`3.11.2-6+deb12u9`	not yet assigned	Not reported	Not reported
Alpine	python3	apk	3.21	`3.12.15-r0`	Not reported	ALPINE-CVE-2026-17084	Not reported
Alpine	python3	apk	3.22	`3.12.15-r0`	Not reported	ALPINE-CVE-2026-17084	Not reported
Alpine	python3	apk	3.23	`3.12.15-r0`	Not reported	ALPINE-CVE-2026-17084	Not reported
Alpine	python3	apk	3.24	`3.14.8-r0`	Not reported	ALPINE-CVE-2026-17084	Not reported
Suse	python313	rpm	linux enterprise module for python 3 15 sp7	`3.13.15-150700.4.56.1`	Not reported	SUSE-SU-2026:4401-1	Not reported
Suse	python313-core	rpm	linux enterprise module for python 3 15 sp7	`3.13.15-150700.4.56.1`	Not reported	SUSE-SU-2026:4401-1	Not reported
Opensuse	python313	rpm	tumbleweed	`3.13.15-1.1`	Not reported	OPENSUSE-SU-2026:11817-1	Not reported
Fedora	python3.14	rpm	43	`0:3.14.8-1.fc43`	Not reported	FEDORA-2026-A3DA6BB5CD#CVE-2026-17084	Not reported
Fedora	python3-docs	rpm	43	`0:3.14.8-1.fc43`	Not reported	FEDORA-2026-A3DA6BB5CD#CVE-2026-17084	Not reported
Fedora	python3.14	rpm	44	`0:3.14.8-1.fc44`	Not reported	FEDORA-2026-6261B26F4E#CVE-2026-17084	Not reported
Fedora	python3-docs	rpm	44	`0:3.14.8-1.fc44`	Not reported	FEDORA-2026-6261B26F4E#CVE-2026-17084	Not reported

[Debian bug #1147445]

Notes

[trixie] pypy3: Minor issue [bookworm] pypy3: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[idle-python3.11]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-dbg]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-dev]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-minimal]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-stdlib]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-testsuite]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[pypy3]Affected
Details (2)
- 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-dev]Affected
Source package: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-doc]Affected
Source package: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-lib]Affected
Source package: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-lib-testsuite]Affected
Source package: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-tk]Affected
Source package: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-venv]Affected
Source package: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Affected
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[python3.11]Affected
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-dbg]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-dev]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-doc]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-examples]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-full]Affected
Source package: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Affected · Fixed: 3.11.2-6+deb12u9
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12

Next results

Observed: Oct 23, 2026, 9:38:45 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Fedora security updates (Bodhi)] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]