Executive brief
A vulnerability in a core Go networking library allows attackers to bypass security checks by using specially formatted web addresses. This occurs because the library incorrectly processes certain encoded domain names, treating them as equivalent to restricted names. An attacker could use this to gain unauthorized access or elevated privileges in applications that rely on this library for security validation.
Technical details
The vulnerability exists in the golang.org/x/net/idna package due to an improper implementation of the UTS 46 processing algorithm. Specifically, the ToASCII and ToUnicode functions fail to reject Punycode-encoded labels (e.g., 'xn--example-.com') that decode to pure ASCII strings ('example.com'). This creates a 'double-decoding' or equivalence issue where a security filter might block the ASCII version but allow the Punycode version. If the application later converts the Punycode string to Unicode/ASCII for internal use, it may inadvertently grant access to a restricted resource. This was addressed by updating the package to comply with UTS 46 revision 33.
Affected products
- Go Project x/net/idna before v0.55.0
Timeline
- 2026-04-15: disclosed: Issue opened on Go GitHub repository
- 2026-05-22: advisory: CVE-2026-39821 published
- 2026-05-22: patched: Fixed in golang.org/x/net v0.55.0