CVE-2026-39821
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
At a glance
- Severity
- CRITICAL 9.6
- EPSS
- EPSS 1.83 % · percentile 79 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Go
- NVD status
- Modified
Description
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N | CISA-ADP |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N | redhat-SADP |
| CVSS 3.1 | CRITICAL 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
Weaknesses (CWE)
Advisories
- GO-2026-5026 — Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
European references
- ENISA EUVD · EUVD-2026-31449
- GCVE · GCVE-0-2026-39821
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1376 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1366 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1281 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1249 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0901 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0810 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0788 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*< 0.55.0
Affected products
| Product | Versions |
|---|---|
| Go standard library · net/http | affected 0 < 1.25.13 ; affected 1.26.0-0 < 1.26.6 ; affected 1.27.0-0 < 1.27.0-rc.3 |
| Go standard library · net/http/internal/http2 | affected 0 < 1.25.13 ; affected 1.26.0-0 < 1.26.6 ; affected 1.27.0-0 < 1.27.0-rc.3 |
| golang.org/x/net · golang.org/x/net/idna | affected 0 < 0.55.0 |
References
- https://go.dev/cl/767220
- https://go.dev/issue/78760
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
- https://groups.google.com/g/golang-announce/c/94pEornpRlI
- https://pkg.go.dev/vuln/GO-2026-5026
- https://access.redhat.com/security/cve/CVE-2026-39821
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json
- https://access.redhat.com/errata/RHSA-2026:42079
- https://access.redhat.com/errata/RHSA-2026:42080
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:66350
- https://access.redhat.com/errata/RHSA-2026:54191
- https://access.redhat.com/errata/RHSA-2026:42078
- https://access.redhat.com/errata/RHSA-2026:54757
- https://access.redhat.com/errata/RHSA-2026:54580
- https://access.redhat.com/errata/RHSA-2026:34789
- https://access.redhat.com/errata/RHSA-2026:42082
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:57845
- https://access.redhat.com/errata/RHSA-2026:62549
- https://access.redhat.com/errata/RHSA-2026:65851
- https://access.redhat.com/errata/RHSA-2026:42150
- https://access.redhat.com/errata/RHSA-2026:42151
- https://access.redhat.com/errata/RHSA-2026:42240
- https://access.redhat.com/errata/RHSA-2026:67149
- https://access.redhat.com/errata/RHSA-2026:49702
- https://access.redhat.com/errata/RHSA-2026:67517
- https://access.redhat.com/errata/RHSA-2026:56143
- https://access.redhat.com/errata/RHSA-2026:59546
- https://access.redhat.com/errata/RHSA-2026:53413
- https://access.redhat.com/errata/RHSA-2026:63134
- https://access.redhat.com/errata/RHSA-2026:53374
- https://access.redhat.com/errata/RHSA-2026:51187
- https://access.redhat.com/errata/RHSA-2026:30855
- https://access.redhat.com/errata/RHSA-2026:46395
- https://access.redhat.com/errata/RHSA-2026:37436
- https://access.redhat.com/errata/RHSA-2026:35827
- https://access.redhat.com/errata/RHSA-2026:35826
- https://access.redhat.com/errata/RHSA-2026:65534
- https://access.redhat.com/errata/RHSA-2026:34357
- https://access.redhat.com/errata/RHSA-2026:66432
- https://access.redhat.com/errata/RHSA-2026:39005
- https://access.redhat.com/errata/RHSA-2026:39573
- https://access.redhat.com/errata/RHSA-2026:38995
- https://access.redhat.com/errata/RHSA-2026:30853
- https://access.redhat.com/errata/RHSA-2026:35830
- https://access.redhat.com/errata/RHSA-2026:35831
- https://access.redhat.com/errata/RHSA-2026:66016
- https://access.redhat.com/errata/RHSA-2026:41930
- +109 more
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |