6

CVE-2026-17084: python software foundation cpython Interpretation Conflict

CVSS: 6.0v4.0MediumAwaiting analysis
AliasesALPINE-CVE-2026-17084RHSA-2026:74868UBUNTU-CVE-2026-17084
Published 18-08-2026Last modified 02-10-2026
Open JSON

Vulnerability summary

CVE-2026-17084 is a medium (CVSS 6.0) Interpretation Conflict vulnerability in python software foundation cpython. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
6.0/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.73%
0%100%
Low · +0.13 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 21 · Related 17
OPENSUSE-SU-2026:11748-1OPENSUSE-SU-2026:11817-1OPENSUSE-SU-2026:11868-1OPENSUSE-SU-2026:11886-1OPENSUSE-SU-2026:11949-1OPENSUSE-SU-2026:11975-1

Timeline

  1. 18-08-2026
    PublishedVulnerability first disclosed.
  2. 02-10-2026
    Last modifiedVulnerability information updated.

Description

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

CVSS metrics

8 scores · 8 sources · 2 versions

EPSS trend

Probability

0.73%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

+0.13 pp

From 0.60% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.73%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu11 products
  • python2.7All versions (No fix recorded)
  • python3.10All versions (No fix recorded)
  • python3.11All versions (No fix recorded)
  • python3.12All versions (No fix recorded)
  • python3.14All versions (No fix recorded)
Redhat7 products
  • python3.10< 0:3.10.22-1.hum1
  • python3.10-debug< 0:3.10.22-1.hum1
  • python3.10-devel< 0:3.10.22-1.hum1
  • python3.10-idle< 0:3.10.22-1.hum1
  • python3.10-libs< 0:3.10.22-1.hum1
Chainguard5 products
  • python-3.10< 3.10.21-r4
  • python-3.11< 3.11.16-r5
  • python-3.12< 3.12.14-r6
  • python-3.13< 3.13.15-r6
  • python-3.14< 3.14.7-r6
Debian5 products
  • pypy3All versions (No fix recorded)
  • python3.11< 3.11.2-6+deb12u9
  • python3.13All versions (No fix recorded)
  • python3.14< 3.14.7-3
  • python3.15< 3.15.0~rc2-1
Wolfi5 products
  • python-3.10< 3.10.21-r4
  • python-3.11< 3.11.16-r5
  • python-3.12< 3.12.14-r6
  • python-3.13< 3.13.15-r6
  • python-3.14< 3.14.7-r6
Alpine1 product
  • python3< 3.12.15-r0 | < 3.14.8-r0
Python software foundation1 product
  • cpython< 3.10.22 | ≥ 3.11.0, < 3.11.17 | ≥ 3.12.0, < 3.12.15 | ≥ 3.13.0, < 3.13.16 | ≥ 3.14.0, < 3.14.8 | ≥ 3.15.0a1, < 3.15.0rc2

7 vendors · 35 products

References

25 links
Show all 25 references