CVE-2026-39821

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39821
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-39821.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-39821
Aliases
Downstream
AZL (47)
BELL (1)
CGA (9902)
CLEANSTART (506)
DEBIAN (1)
MGASA (1)
MINI (2147)
openSUSE (101)
RHSA (71)
RLSA (21)
ROOT (1)
SUSE (110)
UBUNTU (1)
Related
ALSA (18)
openSUSE (98)
SUSE (110)
Published
2026-05-22T15:01:21Z
Modified
2026-09-20T18:26:37Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Details

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Database specific 
{
    "cna_assigner":  "Go",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39821.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "1.25.13"
                },
                {
                    "introduced":  "1.26.0-0"
                },
                {
                    "fixed":  "1.26.6"
                },
                {
                    "introduced":  "1.27.0-0"
                },
                {
                    "fixed":  "1.27.0-rc.3"
                },
                {
                    "fixed":  "1.25.13"
                },
                {
                    "introduced":  "1.26.0-0"
                },
                {
                    "fixed":  "1.26.6"
                },
                {
                    "introduced":  "1.27.0-0"
                },
                {
                    "fixed":  "1.27.0-rc.3"
                },
                {
                    "fixed":  "0.55.0"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/golang/net

Affected ranges

Type
GIT
Repo
https://github.com/golang/net
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7770ec48d03fec35e378665337b4faca93c38423
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.55.0"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

v0.*
v0.1.0
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.3.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.36.0
v0.37.0
v0.38.0
v0.39.0
v0.4.0
v0.40.0
v0.41.0
v0.42.0
v0.43.0
v0.44.0
v0.45.0
v0.46.0
v0.47.0
v0.48.0
v0.49.0
v0.5.0
v0.50.0
v0.51.0
v0.52.0
v0.53.0
v0.54.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-39821.json"