The Python stringprep module incorrectly applies Unicode 15.1 attributes to RFC 3454 tables B.2 and B.3, instead of the required Unicode 3.2.0 values. This deviation causes IDNA 2003 domain name processing via the idna codec and stringprep.in_table_b2() to produce mismatched results. As a consequence, a domain name containing newer Unicode characters or updated case‑folding rules may fail to normalize correctly, potentially allowing an attacker to spoof domain names or bypass hostname checks.

CPython implementations from the Python Software Foundation are affected; any Python program that imports the stringprep module and processes internationalized domain names using the idna codec or the in_table_b2() function may experience the inconsistency.

The CVSS score of 6 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting low but non‑zero exploit probability. The flaw can be exercised by code that imports stringprep for domain name handling, which is a common operation in web servers, email validation, and other network applications. Thus, the attack vector is likely remote, relying on the ability to execute Python code with domain name inputs. Without a patch, attackers may cause authentication or routing errors by supplying specially crafted internationalized domain names.