A Unicode-version mismatch makes Python’s str.lower() security-sensitive
Python’s IDNA 2003/StringPrep implementation must use Unicode 3.2 tables, but a seemingly ordinary str.lower() call follows the interpreter’s newer Unicode data. That implementation/specification mismatch can make two components derive different hostnames from the same input, creating a parser differential around IDN validation.
HN commenters connected the bug to SSRF filters, WAFs, certificate or privileged-host checks, and password-reset flows, while stressing that the exploit is situational and requires IDN input. The practical lesson is to keep protocol-mandated canonicalization separate from general-purpose Unicode helpers.