Hi, The following vulnerability was published for pypy3. CVE-2026-17084[0]: | The "stringprep" module didn't process characters from RFC 3454 | tables B.2 or B.3 correctly: the latest Unicode codepoint | attributes were used instead of the specified Unicode 3.2.0. This | behavior would cause mismatches when processing domain names using | IDNA 2003 (the "idna" codec) and the in_table_b2() function of the | "stringprep" module. This only affects domain names containing | characters that were not previously registered or had their Unicode | attributes such as case-folding behavior updated since Unicode | 3.2.0. https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/ https://github.com/python/cpython/issues/155292 https://github.com/python/cpython/pull/155293 Fixed by: https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc (main) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-17084 https://www.cve.org/CVERecord?id=CVE-2026-17084 Please adjust the affected versions in the BTS as needed.
This was fixed in sid. I'll send an MR for the security-tracker. Stefano