Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-39821 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-26 |
| Vendor | Go |
| Product | golang.org/x/net/idna |
| CVSS Score | 10.0 (critical) |
| EPSS Score | 0.0% (percentile: 14%) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(“xn—example-.com”) incorrectly returns the name “example.com” rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject “example.com” but permit “xn—example-.com”. If that program subsequently converts the ASCII hostname to U…
Required Actions
Apply vendor patches or mitigations as soon as available.
Who Is Affected?
This vulnerability affects golang.org/x/net/idna by Go. Check if your organization uses this software and requires updates.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
