CVE-2026-39821

9.6 CRITICAL

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Published: 2026-05-22 · Last updated: 2026-05-29

Severity and scoring

CVSS: 9.6 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE: CWE-1289

Affected products

Vendor	Product
golang	net

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-39821
[Other]https://go.dev/cl/767220
[Other]https://go.dev/issue/78760
[Other]https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
[Vendor advisory]https://pkg.go.dev/vuln/GO-2026-5026

Related CVEs

Same vendor

CVE-2026-42506 — Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree (6.1 MEDIUM)
CVE-2026-42502 — Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree (6.1 MEDIUM)
CVE-2026-27136 — Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree (6.1 MEDIUM)
CVE-2026-25681 — Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree (6.1 MEDIUM)
CVE-2026-25680 — Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service (6.5 MEDIUM)

Same CWE

CVE-2026-42462 — Fedify is a TypeScript library for building federated server apps powered by ActivityPub (7.0 HIGH)
CVE-2026-49942 — Net::CIDR::Set versions through 0.20 for Perl did not validate network masks (7.3 HIGH)
CVE-2026-49940 — Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks (6.5 MEDIUM)
CVE-2026-47674 — Hono is a Web application framework that provides support for any JavaScript runtime (5.3 MEDIUM)
CVE-2026-41213 — @node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js (5.9 MEDIUM)