CVE-2026-17084

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

We have discovered 455 live websites that are affected by CVE-2026-17084.

Run a Free Instant Scan



Affected Software

Product  CPython
Category Programming Languages
Vulnerable Domains455 live websites (100% of CPython install base)
Vulnerable Versions
  • from 0 through 3.15
Vulnerable Versions Count65 versions ( 100% of all versions)



Details

  • Published - Aug 18, 2026
  • Updated - Aug 19, 2026

Credits

  • Bitshift (https://github.com/TheShiftedBit) (reporter)
  • Seth Larson (https://github.com/sethmlarson) (coordinator)
  • Stan Ulbrych (https://github.com/StanFromIreland) (remediation developer)
  • Marc-Andre Lemburg (https://github.com/malemburg) (remediation reviewer)
  • Petr Viktorin (https://github.com/encukou) (remediation reviewer)

Website Distribution by Country

Number of websites using CVE-2026-17084
United States149 websites


Germany62 websites
Singapore28 websites
France22 websites
India19 websites
China13 websites
Russia12 websites
GB12 websites
Switzerland10 websites
Brazil9 websites

Website Distribution by TLD

Number of websites using CVE-2026-17084
.com164 websites
.org40 websites
.net23 websites
.dk23 websites
.de21 websites
.fr8 websites
.ch8 websites
.edu7 websites
.nl7 websites
.it6 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-17084

Top websites that are affected by CVE-2026-17084. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**********.com United States**,***
*********.com Netherlands***,***
*******.***.org Germany***,***
****.***********.***.au Australia***,***
*************.com United States***,***
********.***.***.gr Greece***,***
***.********.it Italy***,***
***************.de Germany*,***,***
****.*****.br Brazil*,***,***
*********.com United States*,***,***
See full domain list

FAQ

A total of 455 websites have been identified as vulnerable to CVE-2026-17084, based on global website indexing conducted by WebTechSurvey.
The CPython is affected by the CVE-2026-17084 vulnerability.
CPython versions up to 3.15 are vulnerable to CVE-2026-17084.
CVE-2026-17084 is resolved in version 3.15 of CPython.