CVE-2026-39821

Publication date 22 May 2026

Last updated 9 June 2026

Ubuntu priority

Cvss 3 Severity Score

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Status

Show unmaintained releases

Package	Ubuntu Release	Status
golang-golang-x-net-dev	26.04 LTS resolute	Not in release
	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Fixed 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3
	18.04 LTS bionic	Fixed 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3
	16.04 LTS xenial	Not affected

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
golang-golang-x-net-dev	Upstream: 8c4c965

Severity score breakdown

Parameter	Value
Base score	9.6 · Critical
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Changed
Confidentiality	High
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

Related Ubuntu Security Notices (USN)

USN-8416-1
Go Networking vulnerability
9 June 2026