Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2026-39821

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library net/http

Default version status: unaffected

  • 0 to < 1.25.13affected
  • 1.26.0-0 to < 1.26.6affected
  • 1.27.0-0 to < 1.27.0-rc.3affected

Go standard library net/http/internal/http2

Default version status: unaffected

  • 0 to < 1.25.13affected
  • 1.26.0-0 to < 1.26.6affected
  • 1.27.0-0 to < 1.27.0-rc.3affected

golang.org/x/net golang.org/x/net/idna

Default version status: unaffected

  • 0 to < 0.55.0affected

References