In short
- CVE-2026-39821 is a CRITICAL (CVSS 9.6) vulnerability affecting golang.org/x/net, stdlib, net (golang).
- Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.9% of all vulnerabilities.
- Fix: update to 0.55.0, 1.26.6, 1.27.0-rc.3, 1.25.13 or later.
| Package | Affected versions | Patched versions |
|---|
| golang.org/x/net Go | < 0.55.0
| 0.55.0
|
| stdlib Go | ≥ 1.26.0-0, < 1.26.6≥ 1.27.0-0, < 1.27.0-rc.3< 1.25.13
| 1.26.61.27.0-rc.31.25.13
|
| net | < 0.55.0
| 0.55.0
|
Description
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.
This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
NVD description
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
More vulnerabilities in golang.org/x/net
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free