{"schema_version":"1.3.1","id":"GO-2026-5026","modified":"2026-08-21T20:38:00Z","published":"2026-05-22T02:46:43Z","aliases":["CVE-2026-39821"],"summary":"Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna","details":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","affected":[{"package":{"name":"stdlib","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.13"},{"introduced":"1.26.0-0"},{"fixed":"1.26.6"},{"introduced":"1.27.0-0"},{"fixed":"1.27.0-rc.3"}]}],"ecosystem_specific":{"imports":[{"path":"net/http","symbols":["Client.CloseIdleConnections","Client.Do","Client.Get","Client.Head","Client.Post","Client.PostForm","ClientConn.Close","ClientConn.RoundTrip","Get","Head","Post","PostForm","Transport.CloseIdleConnections","Transport.NewClientConn","Transport.RoundTrip","http1ClientConn.Close","http1ClientConn.RoundTrip","http2ClientConn.RoundTrip","http2RoundTripper.RoundTrip","idnaASCII"]},{"path":"net/http/internal/http2","symbols":["Transport.AddConn","Transport.RoundTrip","Transport.RoundTripOpt","authorityAddr"]}]}},{"package":{"name":"golang.org/x/net","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.55.0"}]}],"ecosystem_specific":{"imports":[{"path":"golang.org/x/net/idna","symbols":["Profile.ToASCII","Profile.ToUnicode","Profile.process","ToASCII","ToUnicode"]}]}}],"references":[{"type":"FIX","url":"https://go.dev/cl/767220"},{"type":"REPORT","url":"https://go.dev/issue/78760"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"}],"credits":[{"name":"KC1zs4 (https://github.com/KC1zs4)"},{"name":"Longwei Wang (https://github.com/gn00295120)"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5026","review_status":"REVIEWED"}}