Skip to content

CVE-2026-39821 on CTRL-OS 26.05

Aliases: CVE-2026-39821

Packages: go_1_27

Status: In Progress, Resolved

Advisory Information

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Updates

2026-08-17 11:43 CEST

Metadata changes:

  • Status for package go_1_27: “Resolved” (e5bcd467cf926a27830bf0bced347f434271ac0c)

2026-08-17 11:41 CEST

Metadata changes:

  • Status for package go: “In Progress” (caf3d299c87a63b58deab6b597dc7adf4f762ba1)
  • Status for package go_1_26: “In Progress” (caf3d299c87a63b58deab6b597dc7adf4f762ba1)

2026-08-17 11:39 CEST

Metadata changes:

  • Status for package go_1_25: “Resolved” (95b632a8007bdaebc2c08b6e07292702eceade51)

Comment:

Fixed by updating to Go 1.25.3.

2026-08-17 11:38 CEST

Metadata changes:

  • Status for package go: “Acknowledged”
  • Status for package go_1_25: “Acknowledged”
  • Status for package go_1_26: “Acknowledged”