Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

緊急 9.6CVE-2026-39821 · GO-2026-5026 · 22/05/2026 公開 · 17/09/2026 更新

要点

CVE-2026-39821 は golang.org/x/net, stdlib, net (golang) に影響する深刻度「緊急」 (CVSS 9.6) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.8%（全脆弱性の 78.9% より高い）。
対処：0.55.0, 1.26.6, 1.27.0-rc.3, 1.25.13 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
golang.org/x/net Go	`< 0.55.0`	`0.55.0`
stdlib Go	`≥ 1.26.0-0, < 1.26.6≥ 1.27.0-0, < 1.27.0-rc.3< 1.25.13`	`1.26.61.27.0-rc.31.25.13`
net golang	`< 0.55.0`	`0.55.0`

概要

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

NVD の説明

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".