CVE-2026-39821 PUBLISHED

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Assigner: Go
Reserved: 07.04.2026 Published: 22.05.2026 Updated: 22.05.2026

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Product Status

Vendor golang.org/x/net
Product golang.org/x/net/idna
Versions Default: unaffected
  • affected from 0 to 0.55.0 (excl.)

Credits

  • KC1zs4 (https://github.com/KC1zs4)

References

Problem Types

  • CWE-1289: Improper Validation of Unsafe Equivalence in Input