The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Project Subscriptions

Vendors Products
Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8416-1 Go Networking vulnerability
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:23262 cve-icon
https://access.redhat.com/errata/RHSA-2026:23264 cve-icon
https://access.redhat.com/errata/RHSA-2026:26546 cve-icon
https://access.redhat.com/errata/RHSA-2026:26547 cve-icon
https://access.redhat.com/errata/RHSA-2026:30650 cve-icon
https://access.redhat.com/errata/RHSA-2026:30651 cve-icon
https://access.redhat.com/errata/RHSA-2026:30853 cve-icon
https://access.redhat.com/errata/RHSA-2026:30854 cve-icon
https://access.redhat.com/errata/RHSA-2026:30855 cve-icon
https://access.redhat.com/errata/RHSA-2026:33155 cve-icon
https://access.redhat.com/errata/RHSA-2026:33160 cve-icon
https://access.redhat.com/errata/RHSA-2026:33163 cve-icon
https://access.redhat.com/errata/RHSA-2026:33173 cve-icon
https://access.redhat.com/errata/RHSA-2026:33183 cve-icon
https://access.redhat.com/errata/RHSA-2026:33524 cve-icon
https://access.redhat.com/errata/RHSA-2026:33531 cve-icon
https://access.redhat.com/errata/RHSA-2026:34342 cve-icon
https://access.redhat.com/errata/RHSA-2026:34357 cve-icon
https://access.redhat.com/errata/RHSA-2026:34359 cve-icon
https://access.redhat.com/errata/RHSA-2026:34364 cve-icon
https://access.redhat.com/errata/RHSA-2026:34789 cve-icon
https://access.redhat.com/errata/RHSA-2026:35826 cve-icon
https://access.redhat.com/errata/RHSA-2026:35827 cve-icon
https://access.redhat.com/errata/RHSA-2026:35828 cve-icon
https://access.redhat.com/errata/RHSA-2026:35829 cve-icon
https://access.redhat.com/errata/RHSA-2026:35830 cve-icon
https://access.redhat.com/errata/RHSA-2026:35831 cve-icon
https://access.redhat.com/errata/RHSA-2026:35993 cve-icon
https://access.redhat.com/errata/RHSA-2026:35994 cve-icon
https://access.redhat.com/errata/RHSA-2026:36105 cve-icon
https://access.redhat.com/errata/RHSA-2026:36167 cve-icon
https://access.redhat.com/errata/RHSA-2026:36207 cve-icon
https://access.redhat.com/errata/RHSA-2026:36648 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36796 cve-icon
https://access.redhat.com/errata/RHSA-2026:36797 cve-icon
https://access.redhat.com/errata/RHSA-2026:36808 cve-icon
https://access.redhat.com/errata/RHSA-2026:36820 cve-icon
https://access.redhat.com/errata/RHSA-2026:36883 cve-icon
https://access.redhat.com/errata/RHSA-2026:37387 cve-icon
https://access.redhat.com/errata/RHSA-2026:37435 cve-icon
https://access.redhat.com/errata/RHSA-2026:37436 cve-icon
https://access.redhat.com/errata/RHSA-2026:38995 cve-icon
https://access.redhat.com/errata/RHSA-2026:39005 cve-icon
https://access.redhat.com/errata/RHSA-2026:39573 cve-icon
https://access.redhat.com/errata/RHSA-2026:39879 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40262 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:41019 cve-icon
https://access.redhat.com/errata/RHSA-2026:41030 cve-icon
https://access.redhat.com/errata/RHSA-2026:41031 cve-icon
https://access.redhat.com/errata/RHSA-2026:41036 cve-icon
https://access.redhat.com/errata/RHSA-2026:41055 cve-icon
https://access.redhat.com/errata/RHSA-2026:41066 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:41930 cve-icon
https://access.redhat.com/errata/RHSA-2026:42043 cve-icon
https://access.redhat.com/errata/RHSA-2026:42047 cve-icon
https://access.redhat.com/errata/RHSA-2026:42048 cve-icon
https://access.redhat.com/errata/RHSA-2026:42049 cve-icon
https://access.redhat.com/errata/RHSA-2026:42050 cve-icon
https://access.redhat.com/errata/RHSA-2026:42051 cve-icon
https://access.redhat.com/errata/RHSA-2026:42078 cve-icon
https://access.redhat.com/errata/RHSA-2026:42079 cve-icon
https://access.redhat.com/errata/RHSA-2026:42080 cve-icon
https://access.redhat.com/errata/RHSA-2026:42082 cve-icon
https://access.redhat.com/errata/RHSA-2026:42132 cve-icon
https://access.redhat.com/errata/RHSA-2026:42142 cve-icon
https://access.redhat.com/errata/RHSA-2026:42146 cve-icon
https://access.redhat.com/errata/RHSA-2026:42150 cve-icon
https://access.redhat.com/errata/RHSA-2026:42151 cve-icon
https://access.redhat.com/errata/RHSA-2026:42240 cve-icon
https://access.redhat.com/errata/RHSA-2026:42644 cve-icon
https://access.redhat.com/errata/RHSA-2026:42796 cve-icon
https://access.redhat.com/errata/RHSA-2026:42852 cve-icon
https://access.redhat.com/errata/RHSA-2026:43038 cve-icon
https://access.redhat.com/errata/RHSA-2026:43052 cve-icon
https://access.redhat.com/errata/RHSA-2026:43692 cve-icon
https://access.redhat.com/errata/RHSA-2026:44622 cve-icon
https://access.redhat.com/errata/RHSA-2026:44624 cve-icon
https://access.redhat.com/errata/RHSA-2026:46395 cve-icon
https://access.redhat.com/errata/RHSA-2026:47149 cve-icon
https://access.redhat.com/errata/RHSA-2026:47735 cve-icon
https://access.redhat.com/errata/RHSA-2026:47737 cve-icon
https://access.redhat.com/errata/RHSA-2026:47952 cve-icon
https://access.redhat.com/errata/RHSA-2026:50300 cve-icon
https://access.redhat.com/errata/RHSA-2026:50843 cve-icon
https://access.redhat.com/errata/RHSA-2026:51033 cve-icon
https://access.redhat.com/errata/RHSA-2026:51112 cve-icon
https://access.redhat.com/errata/RHSA-2026:51187 cve-icon
https://access.redhat.com/errata/RHSA-2026:51194 cve-icon
https://access.redhat.com/errata/RHSA-2026:51341 cve-icon
https://access.redhat.com/errata/RHSA-2026:52826 cve-icon
https://access.redhat.com/errata/RHSA-2026:53374 cve-icon
https://access.redhat.com/errata/RHSA-2026:53412 cve-icon
https://access.redhat.com/errata/RHSA-2026:53413 cve-icon
https://access.redhat.com/errata/RHSA-2026:53415 cve-icon
https://access.redhat.com/errata/RHSA-2026:53530 cve-icon
https://access.redhat.com/errata/RHSA-2026:54191 cve-icon
https://access.redhat.com/errata/RHSA-2026:54274 cve-icon
https://access.redhat.com/errata/RHSA-2026:54283 cve-icon
https://access.redhat.com/errata/RHSA-2026:54284 cve-icon
https://access.redhat.com/errata/RHSA-2026:54285 cve-icon
https://access.redhat.com/errata/RHSA-2026:54286 cve-icon
https://access.redhat.com/errata/RHSA-2026:54287 cve-icon
https://access.redhat.com/errata/RHSA-2026:54395 cve-icon
https://access.redhat.com/errata/RHSA-2026:54401 cve-icon
https://access.redhat.com/errata/RHSA-2026:54435 cve-icon
https://access.redhat.com/errata/RHSA-2026:54441 cve-icon
https://access.redhat.com/security/cve/CVE-2026-39821 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2480756 cve-icon
https://go.dev/cl/767220 cve-icon cve-icon
https://go.dev/issue/78760 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 cve-icon cve-icon
https://pkg.go.dev/vuln/GO-2026-5026 cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json cve-icon
History

Thu, 13 Aug 2026 13:30:00 +0000


Wed, 12 Aug 2026 12:30:00 +0000


Tue, 11 Aug 2026 16:00:00 +0000


Fri, 29 May 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*

Wed, 27 May 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Mon, 25 May 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Golang
Golang net
Vendors & Products Golang
Golang net

Fri, 22 May 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-264

Fri, 22 May 2026 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1289
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 22 May 2026 16:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-264

Fri, 22 May 2026 15:45:00 +0000

Type Values Removed Values Added
Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Title Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-08-13T12:04:36.542Z

Reserved: 2026-04-07T18:13:03.526Z

Link: CVE-2026-39821

cve-icon Vulnrichment

Updated: 2026-08-13T12:04:36.542Z

cve-icon NVD

Status : Modified

Published: 2026-05-22T16:16:20.410

Modified: 2026-08-13T13:18:36.027

Link: CVE-2026-39821

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T17:00:17Z

Weaknesses