Executive brief
Python's stringprep module, which is used to normalize and validate internationalized domain names (IDNs), incorrectly processed certain Unicode characters by using modern Unicode standards instead of the older Unicode 3.2.0 version required by the IDNA 2003 specification. This mismatch could cause domain names containing affected characters to be processed differently than intended, potentially leading to validation inconsistencies or domain name handling issues across systems.
Technical details
The stringprep module failed to correctly apply RFC 3454 (StringPrep) requirements, which mandate the use of Unicode 3.2.0 attribute data. Instead, the module used current Unicode codepoint attributes for characters, causing in_table_b2() and related functions to produce incorrect results when processing RFC 3454 tables B.2 and B.3. The vulnerability affects domain names processed via the IDNA 2003 codec containing characters that were either not defined in Unicode 3.2.0 or whose Unicode properties (such as case-folding behavior) changed in later Unicode versions. This is a logic error in the stringprep implementation rather than a classic security vulnerability. Patches have been committed to CPython (commits 1e54caa and 5181304) to enforce Unicode 3.2.0 compliance.
Affected products
- Python CPython 3.14 and below, 3.15 and below
Timeline
- 2026-08-18: disclosed