Python标准库修复由str.lower()引发的IDNA 2003安全漏洞

Python标准库中IDNA 2003的StringPrep实现存在一处安全漏洞，编号为CVE-2026-170841。该漏洞源于StringPrep在大小写折叠步骤中使用了str.lower()函数，而该函数依赖Python解释器自带的Unicode版本（如17.0.0），并未遵循RFC 3454规范所规定的Unicode 3.2.0版本1。这种依赖差异导致域名编码结果不一致，例如对'ᎠᎠ'执行encode('idna')时，符合RFC 3454规范的输出应为'xn--58da'，但在Unicode 17.0.0环境下却输出'xn--kz9aa'1。

修复方法是为特定函数创建新异常，使str.lower()在这些情况下表现得如同使用Unicode 3.2.0，从而让IDNA 2003的实现与规范保持一致1。StringPrep定义于RFC 3454，IDNA 2003定义于RFC 3491，且已被IDNA 2008（RFC 5890-5893）取代1。Python通过idna codec（str.encode('idna')）支持IDNA 2003，并通过idna包支持IDNA 20081。

该漏洞由Bitshift报告，Stan Ulbrych参与修复开发，Marc-Andre Lemburg和Petr Viktorin审查修复1。文章作者Seth Larson为Python Software Foundation的安全驻场开发者，其工作由Alpha-Omega赞助1。

A security vulnerability tracked as CVE-2026-17084 has been identified in the Python standard library's IDNA 2003 StringPrep implementation 1. The flaw originates from the use of the str.lower() function for case folding, which depends on the Unicode version bundled with the Python interpreter, such as version 17.0.0 1. However, the StringPrep specification outlined in RFC 3454 mandates the use of Unicode 3.2.0 for its case folding step, specifically relying on the B.2 and B.3 mapping tables 1. This mismatch between the interpreter's Unicode version and the required standard results in inconsistent domain name encoding, constituting a security vulnerability 1.

To demonstrate this discrepancy, encoding the characters 'ᎠᎠ' with the idna codec outputs 'xn--58da' when compliant with RFC 3454, but generates 'xn--kz9aa' when utilizing Unicode 17.0.0 1. Python supports the IDNA 2003 standard, defined in RFC 3491 and superseded by IDNA 2008 (RFC 5890-5893), through the idna codec, while the current IDNA 2008 standard is handled via the idna package 1. The resolution involves creating new exceptions for specific functions so that str.lower() acts as if it is using Unicode 3.2.0 in these scenarios, bringing the IDNA 2003 implementation into compliance with the specification 1. The vulnerability was reported by Bitshift, with Stan Ulbrych contributing to the fix's development and Marc-Andre Lemburg alongside Petr Viktorin reviewing the solution 1. Seth Larson, a security-in-residence developer at the Python Software Foundation whose work is sponsored by Alpha-Omega, authored the report detailing the vulnerability and its remediation 1.