- Published on
When str.lower() is a security vulnerability in Python β Seth Larson
- Authors
- Name
- DeepHorus
A critical security vulnerability, CVE-2026-17084, has been discovered in Python's built-in implementation of the IDNA 2003 international domain name standard. The flaw exists in how Python handles the case-folding step of the StringPrep algorithm, a core component for mapping non-ASCII characters to ASCII for domain names. This inconsistency between the Python implementation and the required Unicode 3.2.0 standard could lead to security risks in domain name processing.
The vulnerability stems from Python's str.lower() method being used in the case-folding function. This method uses the Unicode version shipped with the specific Python interpreter, which could be any modern version like Unicode 17.0.0. However, the IDNA 2003 specification strictly requires case-folding rules based on the much older Unicode 3.2.0 standard for consistent behavior.
This version mismatch means that for certain characters, the output of Python's .encode('idna') method differs from the specification's required result. For example, the Cherokee syllable "α " (U+13A0) would be encoded differently depending on the Unicode version used for case-folding. Such discrepancies could potentially be exploited in attacks involving internationalized domain names.
The issue was reported by Bitshift and remediated through a collaborative effort. The fix involved creating new exception tables to override the behavior of str.lower() for specific codepoints, ensuring it aligns with Unicode 3.2.0 rules when used within the IDNA 2003 codec. This targeted approach maintains backward compatibility while closing the security gap.
Seth Larson, the Security Developer-in-Residence at the Python Software Foundation, detailed the remediation process. He emphasized the importance of using the more modern idna package from PyPI, which implements IDNA 2008, rather than the legacy .encode('idna') method for new applications. The legacy method is primarily maintained for existing codebases.
Looking ahead, this incident highlights the complexity of maintaining compatibility with older internet standards while leveraging evolving Unicode data. The Python project encourages developers to migrate to IDNA 2008 where possible. The fix, sponsored by the Alpha-Omega organization, underscores the ongoing investment in securing the Python ecosystem's foundational components.
