CVE-2026-39821
published 2026-05-22CVE-2026-39821: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")…
PriorityP356critical9.6CVSS 3.1
AVNACLPRLUINSCCHIHAN
EPSS
0.69%
52.4th percentile
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Affected
114 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | 3scale-rhel7-operator | — | — |
| 3scale-amp2 | 3scale-rhel9-operator | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| ansible-automation-platform-26 | receptor-rhel9 | — | — |
| ansible-automation-platform-27 | receptor-rhel9 | — | — |
| ansible-automation-platform | platform-operator-bundle | — | — |
| build-of-trustee | trustee-rhel9-operator | — | — |
| buildah_project | buildah | — | — |
| cert-manager | jetstack-cert-manager-rhel9 | — | — |
| compliance | openshift-compliance-operator-bundle | — | — |
| compliance | openshift-security-profiles-rhel8-operator | — | — |
| confidential-containers | trustee | — | — |
| container-native-virtualization | kubevirt-apiserver-proxy-rhel9 | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| cryostat | cryostat-storage-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| devworkspace | devworkspace-rhel9-operator | — | — |
| dvo | deployment-validation-rhel8-operator | — | — |
| etcd | etcd | — | — |
| external-secrets-operator | external-secrets-rhel9 | — | — |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
cvelistv5v3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
vendor_redhat9.6CRITICAL
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w2q5-6q6x-x959: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
ghsa_unreviewed·2026-05-26
CVE-2026-39821 [CRITICAL] CWE-1289 GHSA-w2q5-6q6x-x959: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
CVEList
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
cvelistv5·2026-05-22·CVSS 10.0
CVE-2026-39821 [CRITICAL] Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
VulDB
x-net up to 0.54.x on Go improper validation of unsafe equivalence in input
vuldb·2026-05-22
CVE-2026-39821 [LOW] x-net up to 0.54.x on Go improper validation of unsafe equivalence in input
A vulnerability was found in x-net up to 0.54.x on Go. It has been classified as problematic. This impacts an unknown function. This manipulation causes improper validation of unsafe equivalence in input.
The identification of this vulnerability is CVE-2026-39821. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
Ubuntu
Go vulnerability
vendor_ubuntu·2026-10-15
CVE-2026-39821 Go vulnerability
Title: Go vulnerability
Summary: Go could allow unintended access to network services.
USN-8883-1 fixed a vulnerability in Go versions 1.18, 1.21, and 1.24. This
update provides the corresponding fix for Go version 1.23.
Original advisory details:
It was discovered that the Go x/net/idna package incorrectly handled
certain Punycode-encoded labels that decoded to ASCII-only labels. An
attacker could possibly use this issue to bypass hostname-based access
controls and escalate privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Google Guest Agent, Google OS Config Agent vulnerability
vendor_ubuntu·2026-10-12
CVE-2026-39821 Google Guest Agent, Google OS Config Agent vulnerability
Title: Google Guest Agent, Google OS Config Agent vulnerability
Summary: Google Guest Agent and Google OS Config Agent could allow unintended
access to network services.
It was discovered that the Go x/net/idna package, vendored in Google Guest
Agent and Google OS Config Agent, incorrectly accepted Punycode-encoded
labels that decoded to ASCII-only labels when processing internationalized
domain names. A remote attacker could possibly use this issue to bypass
hostname-based access controls and escalate privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Go Networking vulnerabilities
vendor_ubuntu·2026-10-07·CVSS 7.5
CVE-2025-47911 [HIGH] Go Networking vulnerabilities
Title: Go Networking vulnerabilities
Summary: Several security issues were fixed in Go Networking.
It was discovered that Go Networking did not properly handle server
errors after sending a GOAWAY frame during HTTP/2 connection shutdown,
which could cause the connection to hang. A remote attacker could
possibly use this issue to cause a denial of service. (CVE-2022-27664)
It was discovered that Go Networking had quadratic complexity when
decoding HPACK headers in HTTP/2 streams. A remote attacker could
possibly use this issue to cause Go Networking to use excessive
resources, leading to a denial of service. (CVE-2022-41723)
It was discovered that Go Networking incorrectly rendered text nodes
outside of the HTML namespace literally, causing text that should be
escaped to not be escaped.
Ubuntu
Go vulnerability
vendor_ubuntu·2026-10-06
CVE-2026-39821 Go vulnerability
Title: Go vulnerability
Summary: Go could allow unintended access to network services.
It was discovered that the Go x/net/idna package incorrectly handled
certain Punycode-encoded labels that decoded to ASCII-only labels. An
attacker could possibly use this issue to bypass hostname-based access
controls and escalate privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Go Networking vulnerability
vendor_ubuntu·2026-06-09
CVE-2026-39821 Go Networking vulnerability
Title: Go Networking vulnerability
Summary: Go Networking could allow unintended access to network services.
It was discovered that Go Networking incorrectly handled certain
Punycode-encoded labels in the idna package. An attacker could possibly use
this issue to bypass hostname-based access restrictions.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
vendor_redhat·2026-05-22·CVSS 9.6
CVE-2026-39821 [CRITICAL] CWE-1289 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
A flaw was found in the `idna` package, specifically within the `golang.org/x/net/idna` component. This
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-39821 golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing [fedora-all]
bugzilla·2026-06-10·CVSS 9.6
CVE-2026-39821 [CRITICAL] CVE-2026-39821 golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing [fedora-all]
CVE-2026-39821 golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-39821 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
bugzilla·2026-05-22·CVSS 9.6
CVE-2026-39821 [CRITICAL] CVE-2026-39821 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
CVE-2026-39821 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
https://go.dev/cl/767220https://go.dev/issue/78760https://groups.google.com/g/golang-announce/c/94pEornpRlIhttps://groups.google.com/g/golang-announce/c/iI-mYSI0lu8https://pkg.go.dev/vuln/GO-2026-5026https://access.redhat.com/errata/RHSA-2026:23262https://access.redhat.com/errata/RHSA-2026:23264https://access.redhat.com/errata/RHSA-2026:26546https://access.redhat.com/errata/RHSA-2026:26547https://access.redhat.com/errata/RHSA-2026:30650https://access.redhat.com/errata/RHSA-2026:30651https://access.redhat.com/errata/RHSA-2026:30853https://access.redhat.com/errata/RHSA-2026:30854https://access.redhat.com/errata/RHSA-2026:30855https://access.redhat.com/errata/RHSA-2026:33155https://access.redhat.com/errata/RHSA-2026:33160https://access.redhat.com/errata/RHSA-2026:33163https://access.redhat.com/errata/RHSA-2026:33173https://access.redhat.com/errata/RHSA-2026:33183https://access.redhat.com/errata/RHSA-2026:33524https://access.redhat.com/errata/RHSA-2026:33531https://access.redhat.com/errata/RHSA-2026:34342https://access.redhat.com/errata/RHSA-2026:34357https://access.redhat.com/errata/RHSA-2026:34359https://access.redhat.com/errata/RHSA-2026:34364https://access.redhat.com/errata/RHSA-2026:34789https://access.redhat.com/errata/RHSA-2026:35826https://access.redhat.com/errata/RHSA-2026:35827https://access.redhat.com/errata/RHSA-2026:35828https://access.redhat.com/errata/RHSA-2026:35829https://access.redhat.com/errata/RHSA-2026:35830https://access.redhat.com/errata/RHSA-2026:35831https://access.redhat.com/errata/RHSA-2026:35993https://access.redhat.com/errata/RHSA-2026:35994https://access.redhat.com/errata/RHSA-2026:36105https://access.redhat.com/errata/RHSA-2026:36167https://access.redhat.com/errata/RHSA-2026:36207https://access.redhat.com/errata/RHSA-2026:36648https://access.redhat.com/errata/RHSA-2026:36651https://access.redhat.com/errata/RHSA-2026:36796https://access.redhat.com/errata/RHSA-2026:36797https://access.redhat.com/errata/RHSA-2026:36808https://access.redhat.com/errata/RHSA-2026:36820https://access.redhat.com/errata/RHSA-2026:36883https://access.redhat.com/errata/RHSA-2026:37387https://access.redhat.com/errata/RHSA-2026:37435https://access.redhat.com/errata/RHSA-2026:37436https://access.redhat.com/errata/RHSA-2026:38995https://access.redhat.com/errata/RHSA-2026:39005https://access.redhat.com/errata/RHSA-2026:39573https://access.redhat.com/errata/RHSA-2026:39879https://access.redhat.com/errata/RHSA-2026:40118https://access.redhat.com/errata/RHSA-2026:40262https://access.redhat.com/errata/RHSA-2026:40945https://access.redhat.com/errata/RHSA-2026:41019https://access.redhat.com/errata/RHSA-2026:41030https://access.redhat.com/errata/RHSA-2026:41031https://access.redhat.com/errata/RHSA-2026:41036https://access.redhat.com/errata/RHSA-2026:41055https://access.redhat.com/errata/RHSA-2026:41066https://access.redhat.com/errata/RHSA-2026:41928https://access.redhat.com/errata/RHSA-2026:41930https://access.redhat.com/errata/RHSA-2026:42043https://access.redhat.com/errata/RHSA-2026:42047https://access.redhat.com/errata/RHSA-2026:42048https://access.redhat.com/errata/RHSA-2026:42049https://access.redhat.com/errata/RHSA-2026:42050https://access.redhat.com/errata/RHSA-2026:42051https://access.redhat.com/errata/RHSA-2026:42078https://access.redhat.com/errata/RHSA-2026:42079https://access.redhat.com/errata/RHSA-2026:42080https://access.redhat.com/errata/RHSA-2026:42082https://access.redhat.com/errata/RHSA-2026:42132https://access.redhat.com/errata/RHSA-2026:42142https://access.redhat.com/errata/RHSA-2026:42146https://access.redhat.com/errata/RHSA-2026:42150https://access.redhat.com/errata/RHSA-2026:42151https://access.redhat.com/errata/RHSA-2026:42240https://access.redhat.com/errata/RHSA-2026:42644https://access.redhat.com/errata/RHSA-2026:42796https://access.redhat.com/errata/RHSA-2026:42852https://access.redhat.com/errata/RHSA-2026:43038https://access.redhat.com/errata/RHSA-2026:43052https://access.redhat.com/errata/RHSA-2026:43692https://access.redhat.com/errata/RHSA-2026:44622https://access.redhat.com/errata/RHSA-2026:44624https://access.redhat.com/errata/RHSA-2026:46395https://access.redhat.com/errata/RHSA-2026:47149https://access.redhat.com/errata/RHSA-2026:47735https://access.redhat.com/errata/RHSA-2026:47737https://access.redhat.com/errata/RHSA-2026:47952https://access.redhat.com/errata/RHSA-2026:49702https://access.redhat.com/errata/RHSA-2026:49712https://access.redhat.com/errata/RHSA-2026:50300https://access.redhat.com/errata/RHSA-2026:50843https://access.redhat.com/errata/RHSA-2026:51033https://access.redhat.com/errata/RHSA-2026:51112https://access.redhat.com/errata/RHSA-2026:51187https://access.redhat.com/errata/RHSA-2026:51194https://access.redhat.com/errata/RHSA-2026:51341
+ 59 more references
2026-05-22
Published