CVE-2026-39821

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

PUBLISHED Reserved 2026-04-07 | Published 2026-05-22 | Updated 2026-07-06 | Assigner Go

Problem types

CWE-1289: Improper Validation of Unsafe Equivalence in Input

Product status

Credits

KC1zs4 (https://github.com/KC1zs4)

References

access.redhat.com/security/cve/CVE-2026-39821 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2480756 (RHBZ#2480756) issue-tracking

security.access.redhat.com/...2/vex/2026/cve-2026-39821.json

access.redhat.com/errata/RHSA-2026:30855 vendor-advisory

access.redhat.com/errata/RHSA-2026:35827 vendor-advisory

access.redhat.com/errata/RHSA-2026:35826 vendor-advisory

access.redhat.com/errata/RHSA-2026:34357 vendor-advisory

access.redhat.com/errata/RHSA-2026:30853 vendor-advisory

access.redhat.com/errata/RHSA-2026:35830 vendor-advisory

access.redhat.com/errata/RHSA-2026:35831 vendor-advisory

access.redhat.com/errata/RHSA-2026:30854 vendor-advisory

access.redhat.com/errata/RHSA-2026:35828 vendor-advisory

access.redhat.com/errata/RHSA-2026:34359 vendor-advisory

access.redhat.com/errata/RHSA-2026:34342 vendor-advisory

access.redhat.com/errata/RHSA-2026:34364 vendor-advisory

access.redhat.com/errata/RHSA-2026:30651 vendor-advisory

access.redhat.com/errata/RHSA-2026:26547 vendor-advisory

access.redhat.com/errata/RHSA-2026:26546 vendor-advisory

access.redhat.com/errata/RHSA-2026:33531 vendor-advisory

access.redhat.com/errata/RHSA-2026:33524 vendor-advisory

access.redhat.com/errata/RHSA-2026:23262 vendor-advisory

access.redhat.com/errata/RHSA-2026:23264 vendor-advisory

access.redhat.com/errata/RHSA-2026:33155 vendor-advisory

access.redhat.com/errata/RHSA-2026:33160 vendor-advisory

access.redhat.com/errata/RHSA-2026:33163 vendor-advisory

access.redhat.com/errata/RHSA-2026:33173 vendor-advisory

access.redhat.com/errata/RHSA-2026:33183 vendor-advisory

access.redhat.com/errata/RHSA-2026:30650 vendor-advisory

go.dev/cl/767220

go.dev/issue/78760

groups.google.com/g/golang-announce/c/iI-mYSI0lu8

pkg.go.dev/vuln/GO-2026-5026

cve.org (CVE-2026-39821)

nvd.nist.gov (CVE-2026-39821)

Download JSON