{"id":"GO-2026-5026","aliases":["CVE-2026-39821"],"title":"Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna","titleSource":"OSV","descriptionSource":"OSV","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","severity":"unknown","score":null,"published":"2026-05-22T02:46:43.000Z","modified":"2026-11-14T13:12:14.787Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Go","name":"stdlib","sources":[{"name":"OSV · GO-2026-5026","url":"https://osv.dev/vulnerability/GO-2026-5026"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.25.13"},{"introduced":"1.26.0-0"},{"fixed":"1.26.6"},{"introduced":"1.27.0-0"},{"fixed":"1.27.0-rc.3"}],"type":"SEMVER"}],"versions":[],"fixed":["1.25.13","1.26.6","1.27.0-rc.3"]},{"ecosystem":"Go","name":"golang.org/x/net","sources":[{"name":"OSV · GO-2026-5026","url":"https://osv.dev/vulnerability/GO-2026-5026"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.55.0"}],"type":"SEMVER"}],"versions":[],"fixed":["0.55.0"]}],"sourceAffected":[],"references":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"sources":[{"name":"OSV","id":"GO-2026-5026","modified":"2026-11-14T13:12:14.787413175Z","url":"https://osv.dev/vulnerability/GO-2026-5026"}],"assessments":[],"products":[],"remediation":[],"observedAt":"2026-11-14T15:04:49.098Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:50:31.401Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-14T00:35:49.708Z","attemptedAt":"2026-11-14T00:35:49.708Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T00:25:35.871Z","attemptedAt":"2026-11-14T00:25:35.871Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-11-14T00:25:37.994Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-14T00:25:36.401Z","attemptedAt":"2026-11-14T00:25:36.401Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-w2q5-6q6x-x959","url":"https://github.com/advisories/GHSA-w2q5-6q6x-x959","modified":"2026-08-13T15:34:06Z","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-14T00:25:35.871Z"},{"source":"FIRST EPSS","id":"CVE-2026-39821","url":"https://www.first.org/epss/","probability":0.01834,"percentile":0.79246,"date":"2026-11-13","checkedAt":"2026-11-14T00:25:36.401Z"},{"source":"NVD","id":"CVE-2026-39821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","modified":"2026-09-17T12:18:05.767","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-14T00:35:49.708Z"},{"source":"NVD","id":"CVE-2026-39821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","modified":"2026-09-17T12:18:05.767","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-11-14T00:35:49.708Z"}],"aiSummary":null}