Detections
Analytics
CVE-2026-39821
high
Description
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
References
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json
https://pkg.go.dev/vuln/GO-2026-5026
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
https://bugzilla.redhat.com/show_bug.cgi?id=2480756
https://access.redhat.com/security/cve/CVE-2026-39821
https://access.redhat.com/errata/RHSA-2026:47952
https://access.redhat.com/errata/RHSA-2026:47737
https://access.redhat.com/errata/RHSA-2026:47735
https://access.redhat.com/errata/RHSA-2026:47149
https://access.redhat.com/errata/RHSA-2026:46395
https://access.redhat.com/errata/RHSA-2026:44624
https://access.redhat.com/errata/RHSA-2026:44622
https://access.redhat.com/errata/RHSA-2026:43692
https://access.redhat.com/errata/RHSA-2026:43052
https://access.redhat.com/errata/RHSA-2026:43038
https://access.redhat.com/errata/RHSA-2026:42852
https://access.redhat.com/errata/RHSA-2026:42796
https://access.redhat.com/errata/RHSA-2026:42644
https://access.redhat.com/errata/RHSA-2026:42240
https://access.redhat.com/errata/RHSA-2026:42151
https://access.redhat.com/errata/RHSA-2026:42150
https://access.redhat.com/errata/RHSA-2026:42146
https://access.redhat.com/errata/RHSA-2026:42142
https://access.redhat.com/errata/RHSA-2026:42132
https://access.redhat.com/errata/RHSA-2026:42082
https://access.redhat.com/errata/RHSA-2026:42080
https://access.redhat.com/errata/RHSA-2026:42079
https://access.redhat.com/errata/RHSA-2026:42078
https://access.redhat.com/errata/RHSA-2026:42051
https://access.redhat.com/errata/RHSA-2026:42050
https://access.redhat.com/errata/RHSA-2026:42049
https://access.redhat.com/errata/RHSA-2026:42048
https://access.redhat.com/errata/RHSA-2026:42047
https://access.redhat.com/errata/RHSA-2026:42043
https://access.redhat.com/errata/RHSA-2026:41930
https://access.redhat.com/errata/RHSA-2026:41928
https://access.redhat.com/errata/RHSA-2026:41066
https://access.redhat.com/errata/RHSA-2026:41055
https://access.redhat.com/errata/RHSA-2026:41036
https://access.redhat.com/errata/RHSA-2026:41031
https://access.redhat.com/errata/RHSA-2026:41030
https://access.redhat.com/errata/RHSA-2026:41019
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:40262
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:39879
https://access.redhat.com/errata/RHSA-2026:39573
https://access.redhat.com/errata/RHSA-2026:39005
https://access.redhat.com/errata/RHSA-2026:38995
https://access.redhat.com/errata/RHSA-2026:37436
https://access.redhat.com/errata/RHSA-2026:37435
https://access.redhat.com/errata/RHSA-2026:37387
https://access.redhat.com/errata/RHSA-2026:36883
https://access.redhat.com/errata/RHSA-2026:36820
https://access.redhat.com/errata/RHSA-2026:36808
https://access.redhat.com/errata/RHSA-2026:36797
https://access.redhat.com/errata/RHSA-2026:36796
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36648
https://access.redhat.com/errata/RHSA-2026:36207
https://access.redhat.com/errata/RHSA-2026:36167
https://access.redhat.com/errata/RHSA-2026:36105
https://access.redhat.com/errata/RHSA-2026:35994
https://access.redhat.com/errata/RHSA-2026:35993
https://access.redhat.com/errata/RHSA-2026:35831
https://access.redhat.com/errata/RHSA-2026:35830
https://access.redhat.com/errata/RHSA-2026:35829
https://access.redhat.com/errata/RHSA-2026:35828
https://access.redhat.com/errata/RHSA-2026:35827
https://access.redhat.com/errata/RHSA-2026:35826
https://access.redhat.com/errata/RHSA-2026:34789
https://access.redhat.com/errata/RHSA-2026:34364
https://access.redhat.com/errata/RHSA-2026:34359
https://access.redhat.com/errata/RHSA-2026:34357
https://access.redhat.com/errata/RHSA-2026:34342
https://access.redhat.com/errata/RHSA-2026:33531
https://access.redhat.com/errata/RHSA-2026:33524
https://access.redhat.com/errata/RHSA-2026:33183
https://access.redhat.com/errata/RHSA-2026:33173
https://access.redhat.com/errata/RHSA-2026:33163
https://access.redhat.com/errata/RHSA-2026:33160
https://access.redhat.com/errata/RHSA-2026:33155
https://access.redhat.com/errata/RHSA-2026:30855
https://access.redhat.com/errata/RHSA-2026:30854
https://access.redhat.com/errata/RHSA-2026:30853
https://access.redhat.com/errata/RHSA-2026:30651
https://access.redhat.com/errata/RHSA-2026:30650
https://access.redhat.com/errata/RHSA-2026:26547
https://access.redhat.com/errata/RHSA-2026:26546