{"schema_version":"1.9.0","id":"GO-2026-5026","published":"2026-05-22T02:46:43Z","modified":"2026-09-09T10:41:45.015776377Z","aliases":["CVE-2026-39821"],"related":["RHSA-2026:23262","RHSA-2026:23264","RHSA-2026:30853","RHSA-2026:30854","RHSA-2026:30855","RHSA-2026:34357","RHSA-2026:34359","RHSA-2026:34789","RHSA-2026:35826","RHSA-2026:35827","RHSA-2026:35828","RHSA-2026:35829","RHSA-2026:35830","RHSA-2026:35831","RHSA-2026:36796","RHSA-2026:37435","RHSA-2026:37436","RHSA-2026:38995","RHSA-2026:39005","RHSA-2026:39573","RHSA-2026:39879","RHSA-2026:41019","RHSA-2026:41930","RHSA-2026:42078","RHSA-2026:42079","RHSA-2026:42080","RHSA-2026:42082","RHSA-2026:42150","RHSA-2026:42151","RHSA-2026:42240","RHSA-2026:46395","RHSA-2026:49702","RHSA-2026:49712","RHSA-2026:51112","RHSA-2026:51187","RHSA-2026:52826","RHSA-2026:53374","RHSA-2026:53412","RHSA-2026:53413","RHSA-2026:53415","RHSA-2026:54191","RHSA-2026:54401","RHSA-2026:54580","RHSA-2026:54757","RHSA-2026:56143","RHSA-2026:56223","RHSA-2026:57541","RHSA-2026:57649","RHSA-2026:57845","RHSA-2026:59546","RHSA-2026:59549","RHSA-2026:59562","RHSA-2026:60315","RHSA-2026:60354","RHSA-2026:61245","RHSA-2026:61253","RHSA-2026:63134","RHSA-2026:65153","RHSA-2026:65359","RHSA-2026:65534"],"summary":"Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna","details":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","affected":[{"package":{"name":"stdlib","ecosystem":"Go","purl":"pkg:golang/stdlib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.13"},{"introduced":"1.26.0-0"},{"fixed":"1.26.6"},{"introduced":"1.27.0-0"},{"fixed":"1.27.0-rc.3"}]}],"ecosystem_specific":{"imports":[{"path":"net/http","symbols":["Client.CloseIdleConnections","Client.Do","Client.Get","Client.Head","Client.Post","Client.PostForm","ClientConn.Close","ClientConn.RoundTrip","Get","Head","Post","PostForm","Transport.CloseIdleConnections","Transport.NewClientConn","Transport.RoundTrip","http1ClientConn.Close","http1ClientConn.RoundTrip","http2ClientConn.RoundTrip","http2RoundTripper.RoundTrip","idnaASCII"]},{"path":"net/http/internal/http2","symbols":["Transport.AddConn","Transport.RoundTrip","Transport.RoundTripOpt","authorityAddr"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5026.json"}},{"package":{"name":"golang.org/x/net","ecosystem":"Go","purl":"pkg:golang/golang.org/x/net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.55.0"}]}],"ecosystem_specific":{"imports":[{"path":"golang.org/x/net/idna","symbols":["Profile.ToASCII","Profile.ToUnicode","Profile.process","ToASCII","ToUnicode"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5026.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/767220"},{"type":"REPORT","url":"https://go.dev/issue/78760"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-5026"},"credits":[{"name":"KC1zs4 (https://github.com/KC1zs4)"},{"name":"Longwei Wang (https://github.com/gn00295120)"}]}