CVE-2026-39821
published 2026-05-22CVE-2026-39821: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")…
PriorityP355critical9.6CVSS 3.1
AVNACLPRLUINSCCHIHAN
EPSS
0.69%
50.6th percentile
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Affected
107 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | 3scale-rhel7-operator | — | — |
| 3scale-amp2 | 3scale-rhel9-operator | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| ansible-automation-platform-26 | receptor-rhel9 | — | — |
| ansible-automation-platform-27 | receptor-rhel9 | — | — |
| ansible-automation-platform | platform-operator-bundle | — | — |
| build-of-trustee | trustee-rhel9-operator | — | — |
| buildah_project | buildah | — | — |
| cert-manager | jetstack-cert-manager-rhel9 | — | — |
| compliance | openshift-compliance-operator-bundle | — | — |
| compliance | openshift-security-profiles-rhel8-operator | — | — |
| confidential-containers | trustee | — | — |
| container-native-virtualization | kubevirt-apiserver-proxy-rhel9 | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| cryostat | cryostat-storage-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| devworkspace | devworkspace-rhel9-operator | — | — |
| dvo | deployment-validation-rhel8-operator | — | — |
| etcd | etcd | — | — |
| external-secrets-operator | external-secrets-rhel9 | — | — |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
cvelistv5v3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w2q5-6q6x-x959: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
ghsa_unreviewed·2026-05-26
CVE-2026-39821 [CRITICAL] CWE-1289 GHSA-w2q5-6q6x-x959: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
CVEList
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
cvelistv5·2026-05-22·CVSS 10.0
CVE-2026-39821 [CRITICAL] Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
VulDB
x-net up to 0.54.x on Go improper validation of unsafe equivalence in input
vuldb·2026-05-22
CVE-2026-39821 [LOW] x-net up to 0.54.x on Go improper validation of unsafe equivalence in input
A vulnerability was found in x-net up to 0.54.x on Go. It has been classified as problematic. This impacts an unknown function. This manipulation causes improper validation of unsafe equivalence in input.
The identification of this vulnerability is CVE-2026-39821. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
Ubuntu
Go Networking vulnerability
vendor_ubuntu·2026-06-09
CVE-2026-39821 Go Networking vulnerability
Title: Go Networking vulnerability
Summary: Go Networking could allow unintended access to network services.
It was discovered that Go Networking incorrectly handled certain
Punycode-encoded labels in the idna package. An attacker could possibly use
this issue to bypass hostname-based access restrictions.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
vendor_redhat·2026-05-22·CVSS 9.6
CVE-2026-39821 [CRITICAL] CWE-1289 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
A flaw was found in the `idna` package, specifically within the `golang.org/x/net/idna` component. This
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-39821 golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing [fedora-all]
bugzilla·2026-06-10·CVSS 9.6
CVE-2026-39821 [CRITICAL] CVE-2026-39821 golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing [fedora-all]
CVE-2026-39821 golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-39821 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
bugzilla·2026-05-22·CVSS 9.6
CVE-2026-39821 [CRITICAL] CVE-2026-39821 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
CVE-2026-39821 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
https://go.dev/cl/767220https://go.dev/issue/78760https://groups.google.com/g/golang-announce/c/94pEornpRlIhttps://groups.google.com/g/golang-announce/c/iI-mYSI0lu8https://pkg.go.dev/vuln/GO-2026-5026https://access.redhat.com/errata/RHSA-2026:23262https://access.redhat.com/errata/RHSA-2026:23264https://access.redhat.com/errata/RHSA-2026:26546https://access.redhat.com/errata/RHSA-2026:26547https://access.redhat.com/errata/RHSA-2026:30650https://access.redhat.com/errata/RHSA-2026:30651https://access.redhat.com/errata/RHSA-2026:30853https://access.redhat.com/errata/RHSA-2026:30854https://access.redhat.com/errata/RHSA-2026:30855https://access.redhat.com/errata/RHSA-2026:33155https://access.redhat.com/errata/RHSA-2026:33160https://access.redhat.com/errata/RHSA-2026:33163https://access.redhat.com/errata/RHSA-2026:33173https://access.redhat.com/errata/RHSA-2026:33183https://access.redhat.com/errata/RHSA-2026:33524https://access.redhat.com/errata/RHSA-2026:33531https://access.redhat.com/errata/RHSA-2026:34342https://access.redhat.com/errata/RHSA-2026:34357https://access.redhat.com/errata/RHSA-2026:34359https://access.redhat.com/errata/RHSA-2026:34364https://access.redhat.com/errata/RHSA-2026:34789https://access.redhat.com/errata/RHSA-2026:35826https://access.redhat.com/errata/RHSA-2026:35827https://access.redhat.com/errata/RHSA-2026:35828https://access.redhat.com/errata/RHSA-2026:35829https://access.redhat.com/errata/RHSA-2026:35830https://access.redhat.com/errata/RHSA-2026:35831https://access.redhat.com/errata/RHSA-2026:35993https://access.redhat.com/errata/RHSA-2026:35994https://access.redhat.com/errata/RHSA-2026:36105https://access.redhat.com/errata/RHSA-2026:36167https://access.redhat.com/errata/RHSA-2026:36207https://access.redhat.com/errata/RHSA-2026:36648https://access.redhat.com/errata/RHSA-2026:36651https://access.redhat.com/errata/RHSA-2026:36796https://access.redhat.com/errata/RHSA-2026:36797https://access.redhat.com/errata/RHSA-2026:36808https://access.redhat.com/errata/RHSA-2026:36820https://access.redhat.com/errata/RHSA-2026:36883https://access.redhat.com/errata/RHSA-2026:37387https://access.redhat.com/errata/RHSA-2026:37435https://access.redhat.com/errata/RHSA-2026:37436https://access.redhat.com/errata/RHSA-2026:38995https://access.redhat.com/errata/RHSA-2026:39005https://access.redhat.com/errata/RHSA-2026:39573https://access.redhat.com/errata/RHSA-2026:39879https://access.redhat.com/errata/RHSA-2026:40118https://access.redhat.com/errata/RHSA-2026:40262https://access.redhat.com/errata/RHSA-2026:40945https://access.redhat.com/errata/RHSA-2026:41019https://access.redhat.com/errata/RHSA-2026:41030https://access.redhat.com/errata/RHSA-2026:41031https://access.redhat.com/errata/RHSA-2026:41036https://access.redhat.com/errata/RHSA-2026:41055https://access.redhat.com/errata/RHSA-2026:41066https://access.redhat.com/errata/RHSA-2026:41928https://access.redhat.com/errata/RHSA-2026:41930https://access.redhat.com/errata/RHSA-2026:42043https://access.redhat.com/errata/RHSA-2026:42047https://access.redhat.com/errata/RHSA-2026:42048https://access.redhat.com/errata/RHSA-2026:42049https://access.redhat.com/errata/RHSA-2026:42050https://access.redhat.com/errata/RHSA-2026:42051https://access.redhat.com/errata/RHSA-2026:42078https://access.redhat.com/errata/RHSA-2026:42079https://access.redhat.com/errata/RHSA-2026:42080https://access.redhat.com/errata/RHSA-2026:42082https://access.redhat.com/errata/RHSA-2026:42132https://access.redhat.com/errata/RHSA-2026:42142https://access.redhat.com/errata/RHSA-2026:42146https://access.redhat.com/errata/RHSA-2026:42150https://access.redhat.com/errata/RHSA-2026:42151https://access.redhat.com/errata/RHSA-2026:42240https://access.redhat.com/errata/RHSA-2026:42644https://access.redhat.com/errata/RHSA-2026:42796https://access.redhat.com/errata/RHSA-2026:42852https://access.redhat.com/errata/RHSA-2026:43038https://access.redhat.com/errata/RHSA-2026:43052https://access.redhat.com/errata/RHSA-2026:43692https://access.redhat.com/errata/RHSA-2026:44622https://access.redhat.com/errata/RHSA-2026:44624https://access.redhat.com/errata/RHSA-2026:46395https://access.redhat.com/errata/RHSA-2026:47149https://access.redhat.com/errata/RHSA-2026:47735https://access.redhat.com/errata/RHSA-2026:47737https://access.redhat.com/errata/RHSA-2026:47952https://access.redhat.com/errata/RHSA-2026:49702https://access.redhat.com/errata/RHSA-2026:49712https://access.redhat.com/errata/RHSA-2026:50300https://access.redhat.com/errata/RHSA-2026:50843https://access.redhat.com/errata/RHSA-2026:51033https://access.redhat.com/errata/RHSA-2026:51112https://access.redhat.com/errata/RHSA-2026:51187https://access.redhat.com/errata/RHSA-2026:51194https://access.redhat.com/errata/RHSA-2026:51341
+ 41 more references
2026-05-22
Published