The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
References
Configurations
History
21 Jul 2026, 12:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Jul 2026, 12:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
17 Jul 2026, 13:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Jul 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Jul 2026, 13:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Jul 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Jul 2026, 13:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Jun 2026, 03:19
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 May 2026, 15:26
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Golang net
Golang |
|
| References | () https://go.dev/cl/767220 - Issue Tracking | |
| References | () https://go.dev/issue/78760 - Issue Tracking | |
| References | () https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 - Mailing List | |
| References | () https://pkg.go.dev/vuln/GO-2026-5026 - Vendor Advisory | |
| CPE | cpe:2.3:a:golang:net:*:*:*:*:*:go:*:* |
27 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.6 |
22 May 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-22 16:16
Updated : 2026-07-21 12:18
NVD link : CVE-2026-39821
Mitre link : CVE-2026-39821
CVE.ORG link : CVE-2026-39821
JSON object : View
Products Affected
golang
- net
CWE
CWE-1289
Improper Validation of Unsafe Equivalence in Input
