# CVE-2026-39821 ## Summary - **CVE ID:** CVE-2026-39821 - **Severity:** HIGH - **CVSS Score:** 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) - **CWE:** N/A - **Published:** May 22, 2026 - **Last Modified:** Sep 17, 2026 ## Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". ## Affected Products - golang.org/x/net — golang.org/x/net/idna (0) - Go standard library — net/http (0) - Go standard library — net/http (1.26.0-0) - Go standard library — net/http (1.27.0-0) - Go standard library — net/http/internal/http2 (0) - Go standard library — net/http/internal/http2 (1.26.0-0) - Go standard library — net/http/internal/http2 (1.27.0-0) ## References - [CNA](https://go.dev/cl/767220) - [CNA](https://go.dev/issue/78760) - [CNA](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [CNA](https://pkg.go.dev/vuln/GO-2026-5026) - [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-39821) - [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2480756) - [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30855) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30853) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30854) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30651) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26547) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26546) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23262) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23264) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33155) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33160) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33163) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33173) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33183) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30650) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33531) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33524) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34357) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34359) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34342) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34364) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35827) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35826) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35830) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35831) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35828) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34789) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35829) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36207) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36648) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35994) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35993) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36105) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36167) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36796) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36808) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36651) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36820) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36797) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36883) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37387) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37436) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37435) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:39005) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:38995) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:39573) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:39879) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40118) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40262) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40119) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41019) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41030) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40945) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41036) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41031) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41066) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41055) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41930) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42079) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42080) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42078) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42082) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42150) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42151) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42240) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42132) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42142) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41928) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42644) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42146) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42043) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42047) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42050) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42051) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42049) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42048) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42852) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43038) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42796) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43692) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43052) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44624) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:46395) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44622) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:47149) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:47737) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:47735) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:47952) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:50300) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:50843) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51033) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51187) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51112) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51341) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51194) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53374) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:52826) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54191) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53413) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53412) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53415) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53530) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54287) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54285) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54283) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54401) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54441) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54284) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54286) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54274) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54395) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54435) - [CNA](https://groups.google.com/g/golang-announce/c/94pEornpRlI) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54757) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54531) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54580) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56143) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56223) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56340) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56431) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:57194) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:57541) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:57845) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:49702) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59546) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:57649) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59549) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59562) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:49712) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:60354) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:60315) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:60387) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:60520) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:61253) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:61245) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:63134) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:65534) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:65359) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:65886) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:65153) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:65126) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:62549) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:66016) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:66432) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:66022) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67149) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67160) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67159) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:66350) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67517) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67319) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67287) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:65851) - [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:68504) ## Exploitation Prediction (EPSS) - **EPSS Score:** 0.69% - **EPSS Percentile:** 51.1 --- _Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._