Python's str.lower() function creates security flaw in IDNA 2003 domain encoding; vulnerability stems from Unicode version mismatch between RFC 3454 spec requiring 3.2.0 and modern Python interpreters using Unicode 17.0.0, fixed by creating exceptions for case-folding consistency.

When str.lower() is a security vulnerability in Python

Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required. NamePrep was part of that solution, defined in RFC 3491 as a profile of StringPrep, and is crucially a component of Internationalizing Domain Names in Applications (IDNA), also known as “IDNA 2003”. The StringPrep algorithm is defined in RFC 3454. IDNA 2003 has been obsoleted by IDNA 2008 defined in RFC 5890, 5891,...