When str.lower() is a security vulnerability in Python

Python's str.lower() function can be a security vulnerability due to its reliance on the Unicode version included with the interpreter. This is because the StringPrep algorithm, used in Internationalizing Domain Names in Applications (IDNA), depends on the specific version of Unicode, which is Unicode 3.2.0 for IDNA 2003. The Python implementation of StringPrep uses the stringprep module, and it follows the case-folding rules defined in RFC 3454.

The issue arises when str.lower() is called, as it may not behave consistently with the Unicode 3.2.0 case-folding rules used by IDNA. This inconsistency can lead to security vulnerabilities, as the behavior of str.lower() may differ from the specification. To address this issue, the Python community has developed new exceptions to ensure that str.lower() behaves as if using Unicode 3.2.0 specifically for the IDNA 2003 implementation.

This fix was reported by Bitshift and co-developed by Stan Ulbrych, while Marc-Andre Lemburg and Petr Viktorin reviewed the remediation. The CVE identifier for this vulnerability is CVE-2026-17084.