Vulnerability · Published May 22, 2026 · Assigned by Go
CVE-2026-39821Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Critical 9.6
In plain English
A critical-severity security flaw in net/http from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)1.8%top 21.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | delve | 1.26.1-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:10 | git-lfs | 3.7.1-5.el10_2.5 | ALSA-2026:30855 |
| AlmaLinux:8 | git-lfs | 3.4.1-11.el8_10 | ALSA-2026:30853 |
| AlmaLinux:9 | git-lfs | 3.7.1-4.el9_8.1 | ALSA-2026:30854 |
| AlmaLinux:10 | go-fdo-server | 1.0.1-2.el10_2.3 | ALSA-2026:46395 |
| AlmaLinux:10 | go-fdo-server-manufacturer | 1.0.1-2.el10_2.3 | ALSA-2026:46395 |
| AlmaLinux:10 | go-fdo-server-owner | 1.0.1-2.el10_2.3 | ALSA-2026:46395 |
| AlmaLinux:10 | go-fdo-server-rendezvous | 1.0.1-2.el10_2.3 | ALSA-2026:46395 |
| AlmaLinux:10 | go-toolset | 1.26.5-1.el10_2.alma.1 | ALSA-2026:37436 |
| AlmaLinux:8 | go-toolset | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | go-toolset | 1.26.5-1.el9_8 | ALSA-2026:37435 |
| AlmaLinux:10 | golang | 1.26.5-1.el10_2.alma.1 | ALSA-2026:37436 |
| AlmaLinux:8 | golang | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang | 1.26.5-1.el9_8 | ALSA-2026:37435 |
| AlmaLinux:10 | golang-bin | 1.26.5-1.el10_2.alma.1 | ALSA-2026:37436 |
| AlmaLinux:8 | golang-bin | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-bin | 1.26.5-1.el9_8 | ALSA-2026:37435 |
| AlmaLinux:10 | golang-docs | 1.26.5-1.el10_2.alma.1 | ALSA-2026:37436 |
| AlmaLinux:8 | golang-docs | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-docs | 1.26.5-1.el9_8 | ALSA-2026:37435 |
| AlmaLinux:10 | golang-misc | 1.26.5-1.el10_2.alma.1 | ALSA-2026:37436 |
| AlmaLinux:8 | golang-misc | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-misc | 1.26.5-1.el9_8 | ALSA-2026:37435 |
| AlmaLinux:10 | golang-race | 1.26.5-1.el10_2.alma.1 | ALSA-2026:37436 |
| AlmaLinux:8 | golang-race | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-race | 1.26.5-1.el9_8 | ALSA-2026:37435 |
| AlmaLinux:10 | golang-src | 1.26.5-1.el10_2.alma.1 | ALSA-2026:37436 |
| AlmaLinux:8 | golang-src | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-src | 1.26.5-1.el9_8 | ALSA-2026:37435 |
| AlmaLinux:10 | golang-tests | 1.26.5-1.el10_2.alma.1 | ALSA-2026:37436 |
| AlmaLinux:8 | golang-tests | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-tests | 1.26.5-1.el9_8 | ALSA-2026:37435 |
| AlmaLinux:10 | grafana | 10.2.6-27.el10_2 | ALSA-2026:35827 |
| AlmaLinux:8 | grafana | 9.2.10-31.el8_10 | ALSA-2026:35830 |
| AlmaLinux:9 | grafana | 10.2.6-23.el9_8 | ALSA-2026:35828 |
| AlmaLinux:10 | grafana-pcp | 5.3.0-7.el10_2 | ALSA-2026:35826 |
| AlmaLinux:8 | grafana-pcp | 5.1.1-16.el8_10 | ALSA-2026:35831 |
| AlmaLinux:9 | grafana-pcp | 5.1.1-17.el9_8 | ALSA-2026:35829 |
| AlmaLinux:10 | grafana-selinux | 10.2.6-27.el10_2 | ALSA-2026:35827 |
| AlmaLinux:8 | grafana-selinux | 9.2.10-31.el8_10 | ALSA-2026:35830 |
| AlmaLinux:9 | grafana-selinux | 10.2.6-23.el9_8 | ALSA-2026:35828 |
| AlmaLinux:10 | opentelemetry-collector | 0.152.1-1.el10_2 | ALSA-2026:34357 |
| AlmaLinux:9 | opentelemetry-collector | 0.152.1-1.el9_8 | ALSA-2026:34359 |
| AlmaLinux:10 | osbuild-composer | 165.1-5.el10_2.alma.1 | ALSA-2026:66432 |
| AlmaLinux:8 | osbuild-composer | 101.5-2.el8_10.alma.1 | ALSA-2026:66016 |
| AlmaLinux:9 | osbuild-composer | 165.1-4.el9_8.1.alma.1 | ALSA-2026:65153 |
| AlmaLinux:10 | osbuild-composer-core | 165.1-5.el10_2.alma.1 | ALSA-2026:66432 |
| AlmaLinux:8 | osbuild-composer-core | 101.5-2.el8_10.alma.1 | ALSA-2026:66016 |
| AlmaLinux:9 | osbuild-composer-core | 165.1-4.el9_8.1.alma.1 | ALSA-2026:65153 |
| AlmaLinux:10 | osbuild-composer-worker | 165.1-5.el10_2.alma.1 | ALSA-2026:66432 |
| AlmaLinux:8 | osbuild-composer-worker | 101.5-2.el8_10.alma.1 | ALSA-2026:66016 |
| AlmaLinux:9 | osbuild-composer-worker | 165.1-4.el9_8.1.alma.1 | ALSA-2026:65153 |
| AlmaLinux:10 | yggdrasil | 0.4.9.2-1.el10_2 | ALSA-2026:39573 |
| AlmaLinux:10 | yggdrasil-devel | 0.4.9.2-1.el10_2 | ALSA-2026:39573 |
| Alpine:v3.24 | go | 1.26.8-r0 | ALPINE-CVE-2026-39821 |
| Debian:12 | golang-golang-x-net | no fix listed | DEBIAN-CVE-2026-39821 |
| Debian:13 | golang-golang-x-net | no fix listed | DEBIAN-CVE-2026-39821 |
| Debian:14 | golang-golang-x-net | 1:0.55.0-1 | DEBIAN-CVE-2026-39821 |
| Go | golang.org/x/net | 0.55.0 | GO-2026-5026 |
| Go | stdlib | 1.25.13, 1.26.6, 1.27.0-rc.3 | GO-2026-5026 |
| Rocky Linux:8 | delve | 0:1.26.1-1.module+el8.10.0+40244+e7cb3ff8 | RLSA-2026:38995 |
| Rocky Linux:10 | git-lfs | 0:3.7.1-5.el10_2.5 | RLSA-2026:30855 |
| Rocky Linux:8 | git-lfs | 0:3.4.1-11.el8_10 | RLSA-2026:30853 |
| Rocky Linux:9 | git-lfs | 0:3.7.1-4.el9_8.1 | RLSA-2026:30854 |
| Rocky Linux:10 | go-fdo-server | 0:1.0.1-2.el10_2.3 | RLSA-2026:46395 |
| Rocky Linux:10 | golang | 0:1.26.5-1.el10_2 | RLSA-2026:37436 |
| Rocky Linux:8 | golang | 0:1.26.5-1.module+el8.10.0+40244+e7cb3ff8 | RLSA-2026:38995 |
| Rocky Linux:9 | golang | 0:1.26.5-1.el9_8 | RLSA-2026:37435 |
| Rocky Linux:10 | grafana | 0:10.2.6-27.el10_2 | RLSA-2026:35827 |
| Rocky Linux:8 | grafana | 0:9.2.10-31.el8_10 | RLSA-2026:35830 |
| Rocky Linux:9 | grafana | 0:10.2.6-23.el9_8 | RLSA-2026:35828 |
| Rocky Linux:10 | grafana-pcp | 0:5.3.0-7.el10_2 | RLSA-2026:35826 |
| Rocky Linux:8 | grafana-pcp | 0:5.1.1-16.el8_10 | RLSA-2026:35831 |
| Rocky Linux:9 | grafana-pcp | 0:5.1.1-17.el9_8 | RLSA-2026:35829 |
| Rocky Linux:10 | image-builder | 0:52.1-1.el10_2.2.rocky.0.1 | RLSA-2026:65534 |
| Rocky Linux:9 | image-builder | 0:52.1-1.el9_8.2 | RLSA-2026:65886 |
| Rocky Linux:10 | opentelemetry-collector | 0:0.152.1-1.el10_2 | RLSA-2026:34357 |
| Rocky Linux:9 | opentelemetry-collector | 0:0.152.1-1.el9_8 | RLSA-2026:34359 |
| Rocky Linux:10 | osbuild-composer | 0:165.1-5.el10_2.rocky.0.1 | RLSA-2026:66432 |
| Rocky Linux:8 | osbuild-composer | 0:101.5-2.el8_10.rocky.0.6 | RLSA-2026:66016 |
| Rocky Linux:9 | osbuild-composer | 0:165.1-4.el9_8.1.rocky.0.1 | RLSA-2026:65153 |
| Rocky Linux:10 | yggdrasil | 0:0.4.9.2-1.el10_2 | RLSA-2026:39573 |
| Ubuntu:22.04:LTS | adsys | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:24.04:LTS | adsys | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.04:LTS | adsys | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.10 | adsys | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | containerd | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.10 | containerd | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.3 | USN-8883-1 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.3 | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.4 | USN-8883-1 |
| Ubuntu:22.04:LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.4 | UBUNTU-CVE-2026-39821 |
| Ubuntu:24.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:24.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.23 | 1.23.1-1~22.04.3 | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.23 | 1.23.1-1~22.04.3 | USN-8883-2 |
| Ubuntu:24.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.24 | 1.24.13-2~22.04.2 | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.24 | 1.24.13-2~22.04.2 | USN-8883-1 |
| Ubuntu:24.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:24.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:24.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.10 | golang-1.26 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.10 | golang-1.27 | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-golang-x-net | 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1 | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | golang-golang-x-net | 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1 | USN-8900-1 |
| Ubuntu:26.04:LTS | golang-golang-x-net | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.10 | golang-golang-x-net | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | google-guest-agent | 20250116.00-0ubuntu1~22.04.4 | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | google-guest-agent | 20250116.00-0ubuntu1~22.04.4 | USN-8914-1 |
| Ubuntu:24.04:LTS | google-guest-agent | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.04:LTS | google-guest-agent | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.10 | google-guest-agent | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | google-osconfig-agent | 20251028.00-0ubuntu2~22.04.1 | UBUNTU-CVE-2026-39821 |
| Ubuntu:22.04:LTS | google-osconfig-agent | 20251028.00-0ubuntu2~22.04.1 | USN-8914-1 |
| Ubuntu:24.04:LTS | google-osconfig-agent | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.04:LTS | google-osconfig-agent | no fix listed | UBUNTU-CVE-2026-39821 |
| Ubuntu:26.10 | google-osconfig-agent | no fix listed | UBUNTU-CVE-2026-39821 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/http | 0 – before 1.25.131.26.0-0 – before 1.26.61.27.0-0 – before 1.27.0-rc.3 |
| Go standard library | net/http/internal/http2 | 0 – before 1.25.131.26.0-0 – before 1.26.61.27.0-0 – before 1.27.0-rc.3 |
| golang.org/x/net | golang.org/x/net/idna | 0 – before 0.55.0 |
Weakness: CWE-1289 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References
- https://go.dev/cl/767220
- https://go.dev/issue/78760
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
- https://groups.google.com/g/golang-announce/c/94pEornpRlI
- https://pkg.go.dev/vuln/GO-2026-5026
- https://access.redhat.com/security/cve/CVE-2026-39821 vdb-entry, x_refsource_REDHAT
- RHBZ#2480756 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:42079 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42080 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41019 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66350 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54191 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42078 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54757 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54580 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34789 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42082 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36796 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57845 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62549 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65851 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42150 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42151 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42240 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:67149 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:49702 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:67517 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56143 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59546 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53413 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63134 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53374 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51187 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30855 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:46395 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37436 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35827 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35826 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65534 vendor-advisory, x_refsource_REDHAT