CVE-2026-39821: Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-22 · updated 2026-09-17
Weakness: CWE-1289

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Affected products

golang.org/x/net/html: before 0.55.0 — fixed in 0.55.0
Golang.Org/X/Net: before 0.55.0 — fixed in 0.55.0
Go Stdlib: before 1.25.13; from 1.26.0-0 before 1.26.6; from 1.27.0-0 before 1.27.0-rc.3 — fixed in 1.25.13, 1.26.6, 1.27.0-rc.3

How to fix

Upgrade to a fixed version: golang.org/x/net/html 0.55.0; Golang.Org/X/Net 0.55.0; Go Stdlib 1.25.13, 1.26.6, 1.27.0-rc.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-39821 or the next vulnerability affects your stack