CVE-2026-39821

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

CVSS breakdown

Affected products

• Golang / net0.55.0
• golang.org/x/net / golang.org/x/net/idna0 – 0.55.0
• Go standard library / net/http1.26.0-0 – 1.26.6
• Go standard library / net/http1.27.0-0 – 1.27.0-rc.3
• Go standard library / net/http0 – 1.25.13
• Go standard library / net/http/internal/http20 – 1.25.13
• Go standard library / net/http/internal/http21.26.0-0 – 1.26.6
• Go standard library / net/http/internal/http21.27.0-0 – 1.27.0-rc.3

References

• MISChttps://go.dev/cl/767220
• MISChttps://go.dev/issue/78760
• MISChttps://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• MISChttps://groups.google.com/g/golang-announce/c/94pEornpRlI
• MISChttps://pkg.go.dev/vuln/GO-2026-5026