The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
References
| Link | Resource |
|---|---|
| https://go.dev/cl/767220 | Issue Tracking |
| https://go.dev/issue/78760 | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 | Mailing List |
| https://pkg.go.dev/vuln/GO-2026-5026 | Vendor Advisory |
Configurations
History
29 May 2026, 15:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:golang:net:*:*:*:*:*:go:*:* | |
| References | () https://go.dev/cl/767220 - Issue Tracking | |
| References | () https://go.dev/issue/78760 - Issue Tracking | |
| References | () https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 - Mailing List | |
| References | () https://pkg.go.dev/vuln/GO-2026-5026 - Vendor Advisory | |
| First Time |
Golang net
Golang |
27 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.6 |
22 May 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-22 16:16
Updated : 2026-05-29 15:26
NVD link : CVE-2026-39821
Mitre link : CVE-2026-39821
CVE.ORG link : CVE-2026-39821
JSON object : View
Products Affected
golang
- net
CWE
CWE-1289
Improper Validation of Unsafe Equivalence in Input