When str.lower() is a security vulnerability in Python
Summary
The article explains a Python security vulnerability tied to Unicode handling in IDNA processing. It covers how IDNA 2003 versus IDNA 2008 behavior, driven by Unicode version differences and StringPrep, can lead to inconsistent domain name encoding, references CVE-2026-17084, and discusses remediation (prefer the idna package and correct Unicode handling) with attribution to researchers.