{"id":"GO-2026-5026","revision":"10d3b95ded6449288e16f138d32e7ff9","records":[{"revision":"10d3b95ded6449288e16f138d32e7ff9","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5026","aliases":["CVE-2026-39821"],"title":"Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","state":0,"publishedAt":"2026-05-22T02:46:43+00:00","modifiedAt":"2026-10-16T10:42:05.1643025+00:00","affected":[{"ecosystem":"Go","name":"stdlib","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.25.13"},{"kind":"introduced","version":"1.26.0-0"},{"kind":"fixed","version":"1.26.6"},{"kind":"introduced","version":"1.27.0-0"},{"kind":"fixed","version":"1.27.0-rc.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"golang.org/x/net","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.55.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5026","license":"OSV · upstream source license applies","key":"osv:GO-2026-5026","identifiers":["GO-2026-5026","CVE-2026-39821"]},"retained":false,"historicalAffected":[]}],"coverage":[]}