CVE-2026-39821 — Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Description (CNA)

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Affected (CNA)

Vendor / product	Versions
Go standard library / net/http	affected 0 before 1.25.13; affected 1.26.0-0 before 1.26.6; affected 1.27.0-0 before 1.27.0-rc.3
Go standard library / net/http/internal/http2	affected 0 before 1.25.13; affected 1.26.0-0 before 1.26.6; affected 1.27.0-0 before 1.27.0-rc.3
golang.org/x/net / golang.org/x/net/idna	affected 0 before 0.55.0

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.