Python security fixes: CVE-2026-17084,15806,19672

[Joe Locash]

Recent security updates:

Subject: 	[Security-announce][CVE-2026-17084] StringPrep algorithm considered 
Unicode codepoint attributes outside Unicode 3.2.0
Date: 	Tue, 18 Aug 2026 13:55:39 +0000
From: 	Seth Larson <seth@...hon.org>
Reply-To: 	security-sig@...hon.org
To: 	security-announce@...hon.org

There is a MEDIUM severity vulnerability affecting CPython.

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or 
B.3 correctly: the latest Unicode codepoint attributes were used instead of the 
specified Unicode 3.2.0. This behavior would cause mismatches when processing 
domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function 
of the "stringprep" module. This only affects domain names containing characters 
that were not previously registered or had their Unicode attributes such as 
case-folding behavior updated since Unicode 3.2.0.

Please see the linked CVE ID for the latest information on affected versions:

* https://www.cve.org/CVERecord?id=CVE-2026-17084
* https://github.com/python/cpython/pull/155293

Backport for the 3.14 branch: ​https://github.com/python/cpython/pull/156020

This is still open.

Subject: 	[Security-announce][CVE-2026-15806] urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme
Date: 	Tue, 18 Aug 2026 15:38:30 +0000
From: 	Kirill Podoprigora via Security-announce <security-announce@...hon.org>
Reply-To: 	security-sig@...hon.org
To: 	security-announce@...hon.org
CC: 	Kirill Podoprigora <kirill.bast@...il.com>


There is a MEDIUM severity vulnerability affecting CPython.

   The HTTPPasswordMgr class in the urllib.request module, along with its
subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth,
did not take the URL scheme into account when matching stored credentials
against a requested URL. Credentials added for an https:// URL were also used
for requests to the same host over http://, so an attacker able to redirect or
downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect
or an on-path position) could capture credentials in cleartext. Credentials
added for http:// URLs could likewise be sent over https://.

   Credential matching is now scoped by URL scheme. Credentials registered with
a URL that includes a scheme are only used for requests with the same scheme.
Credentials registered with a bare authority (such as example.com or
example.com:8080) continue to match any scheme, preserving compatibility with
existing code, including proxy authentication.

   Users who cannot upgrade immediately can mitigate by ensuring that
applications never make plain http:// requests to hosts for which credentials
are registered, for example by not following redirects to http:// URLs.

Please see the linked CVE ID for the latest information on affected versions:
- https://www.cve.org/CVERecord?id=CVE-2026-15806
- https://github.com/python/cpython/pull/155696

Backport for the 3.14 branch: ​https://github.com/python/cpython/pull/155969

Merged.

Subject: 	[Security-announce][CVE-2026-19672] tarfile extraction filter bypass allows creation of directories outside the destination
Date: 	Wed, 19 Aug 2026 14:56:06 +0100
From: 	Stan Ulbrych via Security-announce <security-announce@...hon.org>
Reply-To: 	security-sig@...hon.org
To: 	security-announce@...hon.org
CC: 	Stan Ulbrych <stanulbrych@...il.com>

There is a MEDIUM severity vulnerability affecting CPython.

The tarfile module's tar and data extraction filters created directories outside
the destination for members whose name leaves the destination and returns to it,
such as ../evil/../dest/sub/file. The containment check used the resolved path,
but intermediate directories were created from the name as given.

Only empty directories are created outside the destination. Member contents are
still extracted inside it. To return to the destination the member's name must
contain the destination directory's own final component, so extraction into a
secure randomised directory is not affected.

This affects POSIX platforms only. On Windows, .. components are collapsed
before the path reaches the filesystem, so the directories outside the
destination are never created.

Please see the linked CVE ID for the latest information on affected versions:

* https://www.cve.org/CVERecord?id=CVE-2026-19672
* https://github.com/python/cpython/pull/156000

Backport for the 3.14 branch: ​https://github.com/python/cpython/pull/156041

Merged.