Python's str.lower() Can Be a Security Vulnerability

When str.lower() is a security vulnerability in Python – Seth Larson

Seth Larson explains how Python's str.lower() can introduce security vulnerabilities in IDNA 2003 implementations. The issue arises because str.lower() uses the Unicode version shipped with the interpreter, while the StringPrep specification (RFC 3454) requires Unicode 3.2.0 case-folding rules. This discrepancy can lead to incorrect domain name processing, as demonstrated with Cherokee characters. The fix involves adding exceptions to mimic Unicode 3.2.0 behavior. The vulnerability is tracked as CVE-2026-17084.