When str.lower() is a security vulnerability in Python – Seth Larson

Python's `str.lower()` method creates a security vulnerability in IDNA (Internationalized Domain Names in Applications) implementations because it uses the current Unicode version instead of the required Unicode 3.2.0 specification defined in RFC 3454. This causes inconsistent case-folding behavior, potentially allowing domain name collisions or bypasses, as demonstrated by the string "ᎠᎠ" encoding to different values depending on the Unicode version used.