CVE-2026-39821

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
References
Link Resource
https://go.dev/cl/767220 Issue Tracking
https://go.dev/issue/78760 Issue Tracking
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 Mailing List
https://pkg.go.dev/vuln/GO-2026-5026 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:23262
https://access.redhat.com/errata/RHSA-2026:23264
https://access.redhat.com/errata/RHSA-2026:26546
https://access.redhat.com/errata/RHSA-2026:26547
https://access.redhat.com/errata/RHSA-2026:30650
https://access.redhat.com/errata/RHSA-2026:30651
https://access.redhat.com/errata/RHSA-2026:30853
https://access.redhat.com/errata/RHSA-2026:30854
https://access.redhat.com/errata/RHSA-2026:30855
https://access.redhat.com/errata/RHSA-2026:33155
https://access.redhat.com/errata/RHSA-2026:33160
https://access.redhat.com/errata/RHSA-2026:33163
https://access.redhat.com/errata/RHSA-2026:33173
https://access.redhat.com/errata/RHSA-2026:33183
https://access.redhat.com/errata/RHSA-2026:33524
https://access.redhat.com/errata/RHSA-2026:33531
https://access.redhat.com/errata/RHSA-2026:34342
https://access.redhat.com/errata/RHSA-2026:34357
https://access.redhat.com/errata/RHSA-2026:34359
https://access.redhat.com/errata/RHSA-2026:34364
https://access.redhat.com/errata/RHSA-2026:34789
https://access.redhat.com/errata/RHSA-2026:35826
https://access.redhat.com/errata/RHSA-2026:35827
https://access.redhat.com/errata/RHSA-2026:35828
https://access.redhat.com/errata/RHSA-2026:35829
https://access.redhat.com/errata/RHSA-2026:35830
https://access.redhat.com/errata/RHSA-2026:35831
https://access.redhat.com/errata/RHSA-2026:35993
https://access.redhat.com/errata/RHSA-2026:35994
https://access.redhat.com/errata/RHSA-2026:36105
https://access.redhat.com/errata/RHSA-2026:36167
https://access.redhat.com/errata/RHSA-2026:36207
https://access.redhat.com/errata/RHSA-2026:36648
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36796
https://access.redhat.com/errata/RHSA-2026:36797
https://access.redhat.com/errata/RHSA-2026:36808
https://access.redhat.com/errata/RHSA-2026:36820
https://access.redhat.com/errata/RHSA-2026:36883
https://access.redhat.com/errata/RHSA-2026:37387
https://access.redhat.com/errata/RHSA-2026:37435
https://access.redhat.com/errata/RHSA-2026:37436
https://access.redhat.com/errata/RHSA-2026:38995
https://access.redhat.com/errata/RHSA-2026:39005
https://access.redhat.com/errata/RHSA-2026:39573
https://access.redhat.com/errata/RHSA-2026:39879
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:40262
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:41019
https://access.redhat.com/errata/RHSA-2026:41030
https://access.redhat.com/errata/RHSA-2026:41031
https://access.redhat.com/errata/RHSA-2026:41036
https://access.redhat.com/errata/RHSA-2026:41055
https://access.redhat.com/errata/RHSA-2026:41066
https://access.redhat.com/errata/RHSA-2026:41928
https://access.redhat.com/errata/RHSA-2026:41930
https://access.redhat.com/errata/RHSA-2026:42043
https://access.redhat.com/errata/RHSA-2026:42047
https://access.redhat.com/errata/RHSA-2026:42048
https://access.redhat.com/errata/RHSA-2026:42049
https://access.redhat.com/errata/RHSA-2026:42050
https://access.redhat.com/errata/RHSA-2026:42051
https://access.redhat.com/errata/RHSA-2026:42078
https://access.redhat.com/errata/RHSA-2026:42079
https://access.redhat.com/errata/RHSA-2026:42080
https://access.redhat.com/errata/RHSA-2026:42082
https://access.redhat.com/errata/RHSA-2026:42132
https://access.redhat.com/errata/RHSA-2026:42142
https://access.redhat.com/errata/RHSA-2026:42146
https://access.redhat.com/errata/RHSA-2026:42150
https://access.redhat.com/errata/RHSA-2026:42151
https://access.redhat.com/errata/RHSA-2026:42240
https://access.redhat.com/errata/RHSA-2026:42644
https://access.redhat.com/security/cve/CVE-2026-39821
https://bugzilla.redhat.com/show_bug.cgi?id=2480756
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*

History

21 Jul 2026, 12:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:41928 -
  • () https://access.redhat.com/errata/RHSA-2026:42043 -
  • () https://access.redhat.com/errata/RHSA-2026:42047 -
  • () https://access.redhat.com/errata/RHSA-2026:42048 -
  • () https://access.redhat.com/errata/RHSA-2026:42049 -
  • () https://access.redhat.com/errata/RHSA-2026:42050 -
  • () https://access.redhat.com/errata/RHSA-2026:42051 -
  • () https://access.redhat.com/errata/RHSA-2026:42078 -
  • () https://access.redhat.com/errata/RHSA-2026:42079 -
  • () https://access.redhat.com/errata/RHSA-2026:42080 -
  • () https://access.redhat.com/errata/RHSA-2026:42082 -
  • () https://access.redhat.com/errata/RHSA-2026:42132 -
  • () https://access.redhat.com/errata/RHSA-2026:42142 -
  • () https://access.redhat.com/errata/RHSA-2026:42146 -
  • () https://access.redhat.com/errata/RHSA-2026:42150 -
  • () https://access.redhat.com/errata/RHSA-2026:42151 -
  • () https://access.redhat.com/errata/RHSA-2026:42240 -
  • () https://access.redhat.com/errata/RHSA-2026:42644 -

20 Jul 2026, 12:18

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2026:40119', 'source': '0b0ca135-0b70-47e7-9f44-1890c2a1c46c'}
  • () https://access.redhat.com/errata/RHSA-2026:41930 -

17 Jul 2026, 13:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40945 -
  • () https://access.redhat.com/errata/RHSA-2026:41019 -
  • () https://access.redhat.com/errata/RHSA-2026:41030 -
  • () https://access.redhat.com/errata/RHSA-2026:41031 -
  • () https://access.redhat.com/errata/RHSA-2026:41036 -
  • () https://access.redhat.com/errata/RHSA-2026:41055 -
  • () https://access.redhat.com/errata/RHSA-2026:41066 -

16 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:39879 -
  • () https://access.redhat.com/errata/RHSA-2026:40118 -
  • () https://access.redhat.com/errata/RHSA-2026:40119 -
  • () https://access.redhat.com/errata/RHSA-2026:40262 -

15 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:39573 -

14 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:38995 -
  • () https://access.redhat.com/errata/RHSA-2026:39005 -

13 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:37435 -
  • () https://access.redhat.com/errata/RHSA-2026:37436 -

10 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:37387 -

09 Jul 2026, 13:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36651 -
  • () https://access.redhat.com/errata/RHSA-2026:36796 -
  • () https://access.redhat.com/errata/RHSA-2026:36797 -
  • () https://access.redhat.com/errata/RHSA-2026:36808 -
  • () https://access.redhat.com/errata/RHSA-2026:36820 -
  • () https://access.redhat.com/errata/RHSA-2026:36883 -

08 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36105 -
  • () https://access.redhat.com/errata/RHSA-2026:36207 -
  • () https://access.redhat.com/errata/RHSA-2026:36648 -

07 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34789 -
  • () https://access.redhat.com/errata/RHSA-2026:35829 -
  • () https://access.redhat.com/errata/RHSA-2026:35993 -
  • () https://access.redhat.com/errata/RHSA-2026:35994 -
  • () https://access.redhat.com/errata/RHSA-2026:36167 -

06 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:35826 -
  • () https://access.redhat.com/errata/RHSA-2026:35827 -
  • () https://access.redhat.com/errata/RHSA-2026:35828 -
  • () https://access.redhat.com/errata/RHSA-2026:35830 -
  • () https://access.redhat.com/errata/RHSA-2026:35831 -

02 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34342 -
  • () https://access.redhat.com/errata/RHSA-2026:34357 -
  • () https://access.redhat.com/errata/RHSA-2026:34359 -
  • () https://access.redhat.com/errata/RHSA-2026:34364 -

01 Jul 2026, 13:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:33524 -
  • () https://access.redhat.com/errata/RHSA-2026:33531 -

30 Jun 2026, 03:19

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:23262 -
  • () https://access.redhat.com/errata/RHSA-2026:23264 -
  • () https://access.redhat.com/errata/RHSA-2026:26546 -
  • () https://access.redhat.com/errata/RHSA-2026:26547 -
  • () https://access.redhat.com/errata/RHSA-2026:30650 -
  • () https://access.redhat.com/errata/RHSA-2026:30651 -
  • () https://access.redhat.com/errata/RHSA-2026:30853 -
  • () https://access.redhat.com/errata/RHSA-2026:30854 -
  • () https://access.redhat.com/errata/RHSA-2026:30855 -
  • () https://access.redhat.com/errata/RHSA-2026:33155 -
  • () https://access.redhat.com/errata/RHSA-2026:33160 -
  • () https://access.redhat.com/errata/RHSA-2026:33163 -
  • () https://access.redhat.com/errata/RHSA-2026:33173 -
  • () https://access.redhat.com/errata/RHSA-2026:33183 -
  • () https://access.redhat.com/security/cve/CVE-2026-39821 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2480756 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json -

29 May 2026, 15:26

Type Values Removed Values Added
First Time Golang net
Golang
References () https://go.dev/cl/767220 - () https://go.dev/cl/767220 - Issue Tracking
References () https://go.dev/issue/78760 - () https://go.dev/issue/78760 - Issue Tracking
References () https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 - () https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 - Mailing List
References () https://pkg.go.dev/vuln/GO-2026-5026 - () https://pkg.go.dev/vuln/GO-2026-5026 - Vendor Advisory
CPE cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*

27 May 2026, 14:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 10.0
v2 : unknown
v3 : 9.6

22 May 2026, 19:17

Type Values Removed Values Added
New CVE

Information

Published : 2026-05-22 16:16

Updated : 2026-07-21 12:18


NVD link : CVE-2026-39821

Mitre link : CVE-2026-39821

CVE.ORG link : CVE-2026-39821


JSON object : View

Products Affected

golang

  • net
CWE
CWE-1289

Improper Validation of Unsafe Equivalence in Input