The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8416-1 Go Networking vulnerability
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:23262 cve-icon
https://access.redhat.com/errata/RHSA-2026:23264 cve-icon
https://access.redhat.com/errata/RHSA-2026:26546 cve-icon
https://access.redhat.com/errata/RHSA-2026:26547 cve-icon
https://access.redhat.com/errata/RHSA-2026:30650 cve-icon
https://access.redhat.com/errata/RHSA-2026:30651 cve-icon
https://access.redhat.com/errata/RHSA-2026:30853 cve-icon
https://access.redhat.com/errata/RHSA-2026:30854 cve-icon
https://access.redhat.com/errata/RHSA-2026:30855 cve-icon
https://access.redhat.com/errata/RHSA-2026:33155 cve-icon
https://access.redhat.com/errata/RHSA-2026:33160 cve-icon
https://access.redhat.com/errata/RHSA-2026:33163 cve-icon
https://access.redhat.com/errata/RHSA-2026:33173 cve-icon
https://access.redhat.com/errata/RHSA-2026:33183 cve-icon
https://access.redhat.com/errata/RHSA-2026:33524 cve-icon
https://access.redhat.com/errata/RHSA-2026:33531 cve-icon
https://access.redhat.com/errata/RHSA-2026:34342 cve-icon
https://access.redhat.com/errata/RHSA-2026:34357 cve-icon
https://access.redhat.com/errata/RHSA-2026:34359 cve-icon
https://access.redhat.com/errata/RHSA-2026:34364 cve-icon
https://access.redhat.com/errata/RHSA-2026:34789 cve-icon
https://access.redhat.com/errata/RHSA-2026:35826 cve-icon
https://access.redhat.com/errata/RHSA-2026:35827 cve-icon
https://access.redhat.com/errata/RHSA-2026:35828 cve-icon
https://access.redhat.com/errata/RHSA-2026:35829 cve-icon
https://access.redhat.com/errata/RHSA-2026:35830 cve-icon
https://access.redhat.com/errata/RHSA-2026:35831 cve-icon
https://access.redhat.com/errata/RHSA-2026:35993 cve-icon
https://access.redhat.com/errata/RHSA-2026:35994 cve-icon
https://access.redhat.com/errata/RHSA-2026:36105 cve-icon
https://access.redhat.com/errata/RHSA-2026:36167 cve-icon
https://access.redhat.com/errata/RHSA-2026:36207 cve-icon
https://access.redhat.com/errata/RHSA-2026:36648 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36796 cve-icon
https://access.redhat.com/errata/RHSA-2026:36797 cve-icon
https://access.redhat.com/errata/RHSA-2026:36808 cve-icon
https://access.redhat.com/errata/RHSA-2026:36820 cve-icon
https://access.redhat.com/errata/RHSA-2026:36883 cve-icon
https://access.redhat.com/errata/RHSA-2026:37387 cve-icon
https://access.redhat.com/errata/RHSA-2026:37435 cve-icon
https://access.redhat.com/errata/RHSA-2026:37436 cve-icon
https://access.redhat.com/errata/RHSA-2026:38995 cve-icon
https://access.redhat.com/errata/RHSA-2026:39005 cve-icon
https://access.redhat.com/errata/RHSA-2026:39573 cve-icon
https://access.redhat.com/errata/RHSA-2026:39879 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40262 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:41019 cve-icon
https://access.redhat.com/errata/RHSA-2026:41030 cve-icon
https://access.redhat.com/errata/RHSA-2026:41031 cve-icon
https://access.redhat.com/errata/RHSA-2026:41036 cve-icon
https://access.redhat.com/errata/RHSA-2026:41055 cve-icon
https://access.redhat.com/errata/RHSA-2026:41066 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:41930 cve-icon
https://access.redhat.com/errata/RHSA-2026:42043 cve-icon
https://access.redhat.com/errata/RHSA-2026:42047 cve-icon
https://access.redhat.com/errata/RHSA-2026:42048 cve-icon
https://access.redhat.com/errata/RHSA-2026:42049 cve-icon
https://access.redhat.com/errata/RHSA-2026:42050 cve-icon
https://access.redhat.com/errata/RHSA-2026:42051 cve-icon
https://access.redhat.com/errata/RHSA-2026:42078 cve-icon
https://access.redhat.com/errata/RHSA-2026:42079 cve-icon
https://access.redhat.com/errata/RHSA-2026:42080 cve-icon
https://access.redhat.com/errata/RHSA-2026:42082 cve-icon
https://access.redhat.com/errata/RHSA-2026:42132 cve-icon
https://access.redhat.com/errata/RHSA-2026:42142 cve-icon
https://access.redhat.com/errata/RHSA-2026:42146 cve-icon
https://access.redhat.com/errata/RHSA-2026:42150 cve-icon
https://access.redhat.com/errata/RHSA-2026:42151 cve-icon
https://access.redhat.com/errata/RHSA-2026:42240 cve-icon
https://access.redhat.com/errata/RHSA-2026:42644 cve-icon
https://access.redhat.com/errata/RHSA-2026:42796 cve-icon
https://access.redhat.com/errata/RHSA-2026:42852 cve-icon
https://access.redhat.com/errata/RHSA-2026:43038 cve-icon
https://access.redhat.com/errata/RHSA-2026:43052 cve-icon
https://access.redhat.com/errata/RHSA-2026:43692 cve-icon
https://access.redhat.com/errata/RHSA-2026:44622 cve-icon
https://access.redhat.com/errata/RHSA-2026:44624 cve-icon
https://access.redhat.com/errata/RHSA-2026:46395 cve-icon
https://access.redhat.com/errata/RHSA-2026:47149 cve-icon
https://access.redhat.com/errata/RHSA-2026:47735 cve-icon
https://access.redhat.com/errata/RHSA-2026:47737 cve-icon
https://access.redhat.com/errata/RHSA-2026:47952 cve-icon
https://access.redhat.com/errata/RHSA-2026:50300 cve-icon
https://access.redhat.com/errata/RHSA-2026:50843 cve-icon
https://access.redhat.com/errata/RHSA-2026:51033 cve-icon
https://access.redhat.com/errata/RHSA-2026:51112 cve-icon
https://access.redhat.com/errata/RHSA-2026:51187 cve-icon
https://access.redhat.com/errata/RHSA-2026:51194 cve-icon
https://access.redhat.com/errata/RHSA-2026:51341 cve-icon
https://access.redhat.com/errata/RHSA-2026:52826 cve-icon
https://access.redhat.com/errata/RHSA-2026:53374 cve-icon
https://access.redhat.com/errata/RHSA-2026:53412 cve-icon
https://access.redhat.com/errata/RHSA-2026:53413 cve-icon
https://access.redhat.com/errata/RHSA-2026:53415 cve-icon
https://access.redhat.com/errata/RHSA-2026:53530 cve-icon
https://access.redhat.com/errata/RHSA-2026:54191 cve-icon
https://access.redhat.com/errata/RHSA-2026:54274 cve-icon
https://access.redhat.com/errata/RHSA-2026:54283 cve-icon
https://access.redhat.com/errata/RHSA-2026:54284 cve-icon
https://access.redhat.com/errata/RHSA-2026:54285 cve-icon
https://access.redhat.com/errata/RHSA-2026:54286 cve-icon
https://access.redhat.com/errata/RHSA-2026:54287 cve-icon
https://access.redhat.com/errata/RHSA-2026:54395 cve-icon
https://access.redhat.com/errata/RHSA-2026:54401 cve-icon
https://access.redhat.com/errata/RHSA-2026:54435 cve-icon
https://access.redhat.com/errata/RHSA-2026:54441 cve-icon
https://access.redhat.com/security/cve/CVE-2026-39821 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2480756 cve-icon
https://go.dev/cl/767220 cve-icon cve-icon
https://go.dev/issue/78760 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/94pEornpRlI cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 cve-icon cve-icon
https://pkg.go.dev/vuln/GO-2026-5026 cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json cve-icon
History

Thu, 13 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
References

Thu, 13 Aug 2026 13:30:00 +0000


Wed, 12 Aug 2026 12:30:00 +0000


Tue, 11 Aug 2026 16:00:00 +0000


Fri, 29 May 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*

Wed, 27 May 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Mon, 25 May 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Golang
Golang net
Vendors & Products Golang
Golang net

Fri, 22 May 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-264

Fri, 22 May 2026 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1289
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 22 May 2026 16:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-264

Fri, 22 May 2026 15:45:00 +0000

Type Values Removed Values Added
Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Title Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-08-13T21:58:51.046Z

Reserved: 2026-04-07T18:13:03.526Z

Link: CVE-2026-39821

cve-icon Vulnrichment

Updated: 2026-08-13T12:04:36.542Z

cve-icon NVD

Status : Modified

Published: 2026-05-22T16:16:20.410

Modified: 2026-08-13T22:17:19.973

Link: CVE-2026-39821

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T17:00:17Z

Weaknesses