Is CVE-2026-39821 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39821 being exploited in the wild.

How severe is CVE-2026-39821?

Critical severity, with a CVSS score of 9.6, published 22 May 2026.

Which products and versions are affected?

golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.55.0; stdlib (Go) SEMVER:introduced=0,fixed=1.25.13,introduced=1.26.0-0,fixed=1.26.6,introduced=1.27.0-0,fixed=1.27.0-rc.3.

Is there a fix for CVE-2026-39821?

Yes. golang.org/x/net (Go): upgrade to 0.55.0 or later; stdlib (Go): upgrade to 1.27.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39821 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39821?

Check whether you run golang.org/x/net (Go) or stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39821: Go x/net idna privilege escalation via Punycode decoding

CVE-2026-39821 · Severity: critical · CVSS 9.6 · Published 2026-05-22

A vulnerability in a core Go networking library allows attackers to bypass security checks by using specially formatted web addresses. This occurs because the library incorrectly processes certain encoded domain names, treating them as equivalent to restricted names. An attacker could use this to gain unauthorized access or elevated privileges in applications that rely on this library for security validation.

Technologies: golang.org/x/net (Go), stdlib (Go). Vendors: Go.

Quick answers

Is CVE-2026-39821 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39821 being exploited in the wild.
How severe is CVE-2026-39821?: Critical severity, with a CVSS score of 9.6, published 22 May 2026.
Which products and versions are affected?: golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.55.0; stdlib (Go) SEMVER:introduced=0,fixed=1.25.13,introduced=1.26.0-0,fixed=1.26.6,introduced=1.27.0-0,fixed=1.27.0-rc.3.
Is there a fix for CVE-2026-39821?: Yes. golang.org/x/net (Go): upgrade to 0.55.0 or later; stdlib (Go): upgrade to 1.27.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39821 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39821?: Check whether you run golang.org/x/net (Go) or stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/net (Go): upgrade to 0.55.0 or later
```
go get golang.org/x/net@v0.55.0
```
stdlib (Go): upgrade to 1.27.0-rc.3 or later
```
go get stdlib@v1.27.0-rc.3
```

Technical details

The vulnerability exists in the golang.org/x/net/idna package due to an improper implementation of the UTS 46 processing algorithm. Specifically, the ToASCII and ToUnicode functions fail to reject Punycode-encoded labels (e.g., 'xn--example-.com') that decode to pure ASCII strings ('example.com'). This creates a 'double-decoding' or equivalence issue where a security filter might block the ASCII version but allow the Punycode version. If the application later converts the Punycode string to Unicode/ASCII for internal use, it may inadvertently grant access to a restricted resource. This was addressed by updating the package to comply with UTS 46 revision 33.

Affected products

Go Project x/net/idna before v0.55.0

Identifiers

CVE-2026-39821
GO-2026-5026

Timeline

2026-04-15: disclosed: Issue opened on Go GitHub repository
2026-05-22: advisory: CVE-2026-39821 published
2026-05-22: patched: Fixed in golang.org/x/net v0.55.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.