Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

CRÍTICO 9.6CVE-2026-39821 · GO-2026-5026 · Published 22/05/2026 · updated 17/09/2026

Em resumo

CVE-2026-39821 é uma vulnerabilidade CRÍTICO (CVSS 9.6) que afeta golang.org/x/net, stdlib, net (golang).
Chance de exploração nos próximos 30 dias (EPSS): 1.8%, maior que 78.9% das vulnerabilidades.
Correção: atualize para 0.55.0, 1.26.6, 1.27.0-rc.3, 1.25.13 ou posterior.

Package	Affected versions	Patched versions
golang.org/x/net Go	`< 0.55.0`	`0.55.0`
stdlib Go	`≥ 1.26.0-0, < 1.26.6≥ 1.27.0-0, < 1.27.0-rc.3< 1.25.13`	`1.26.61.27.0-rc.31.25.13`
net golang	`< 0.55.0`	`0.55.0`

Description

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

NVD description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".