CVE-2026-39821criticalCWE-1289

CVE-2026-39821: critical vulnerability in golang.org/x/net/idna

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Published · Updated

Follow this CVE+ Monitor net/http+ Monitor net/http/internal/http2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.6epss 1.8%
In short

A flaw in Go's domain name processing allows attackers to bypass security checks by using a hidden encoding (Punycode) for domain names. An attacker could gain unauthorized access by using an encoded version of a domain that a security system thought it had blocked.

Technical detail

The idna package's ToASCII and ToUnicode functions fail to reject Punycode-encoded labels that decode to ASCII-only strings, enabling bypass of hostname-based access controls. An attacker can supply a Punycode domain (e.g., 'xn--example-.com') that decodes to a legitimate ASCII domain, allowing the application to pass validation checks that would normally deny the ASCII version, leading to privilege escalation.

Summary generated and translated by AI from the official description.
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected products
golang.org/x/net · golang.org/x/net/idnaGo standard library · net/httpGo standard library · net/http/internal/http2
Related CVEs — golang.org/x/net/idna

In the same product, most dangerous first.

CVE-2023-45288HIGHHTTP/2 CONTINUATION flood in net/httpEPSS 89.5%CVE-2022-41717—Excessive memory growth in net/http and golang.org/x/net/http2EPSS 6.1%CVE-2022-41723HIGHDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netEPSS 4.6%CVE-2023-39325—HTTP/2 rapid reset can cause excessive work in net/httpEPSS 3.8%CVE-2022-1705MEDIUMImproper sanitization of Transfer-Encoding headers in net/httpEPSS 1.5%CVE-2022-32148MEDIUMExposure of client IP addresses in net/httpEPSS 1.5%