Skip to main content

Golang Org X Net Idna CVE-2026-39821

| EUVDEUVD-2026-31449 CRITICAL
Improper Validation of Unsafe Equivalence in Input (CWE-1289)
2026-05-22 Go GHSA-w2q5-6q6x-x959
Privilege Escalation Golang Org X Net Idna Golang Org X Net
9.6
CVSS 3.1 · Vendor: Go
View

Vulnerability Assessment

Weakness
CWE
CWE-1289
ASVS 5.0
V15 - Secure Coding and Architecture Hardware access control
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 27, 2026

Privilege escalation in Go's golang.org/x/net/idna package (all versions before 0.55.0) stems from ToASCII and ToUnicode accepting Punycode labels that decode to an ASCII-only label, so ToUnicode("xn--example-.com") returns "example.com" instead of an error. Applications that perform authorization checks on an ASCII hostname and then convert it to Unicode can be tricked into permitting a name that the direct check would have rejected. This is a library-level flaw (CVSS 9.6, scope-changed) reported by the Go team; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile).

Affected VersionsENISA

golang.org/x/net/idna 0 <0.55.0

Affected Packages

go golang.org/x/net fix: 0.55.0
go stdlib fix: 1.25.13, 1.26.6, 1.27.0-rc.3
euvd golang_org_x_net_idna fix: 0.55.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Golang Org X Net Idna gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Go) PRIMARY 9.6 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
SUSE CRITICAL
Red Hat 8.2 HIGH

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
CVSS changed
May 27, 2026 - 19:37 NVD
10.0 (None) 9.6 (CRITICAL)
CVE Published
May 22, 2026 - 15:01 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Executive ViewAI

Why It Matters

A critical privilege escalation flaw in Go's idna package (versions before 0.55.0) allows attackers to bypass hostname-based authorization controls by submitting punycode domains that decode to different ASCII hostnames, potentially granting unauthorized access to protected resources in affected applications. Organizations using golang.org/x/net/idna for domain validation in authentication or access control systems face immediate risk of authorization bypass, requiring priority patching across the Go application portfolio.

Recommended Action

Within 24 hours: Inventory all applications and services using golang.org/x/net/idna package and map deployment locations. Within 7 days: Update golang.org/x/net/idna to version 0.55.0 or later, rebuild affected binaries, and deploy to non-production environments with validation testing. Within 30 days: Deploy patched versions to all production systems, verify patch application via module inspection, and audit recent access logs for anomalous hostname patterns (particularly punycode domains) that may indicate exploitation attempts.

Business Impact: High
Compensating Controls

Apply vendor patch (golang.org/x/net/idna version 0.55.0 or later).

Threat Intelligence Overview

EPSS Score
0.0%
Top 86% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +48
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Same weakness CWE-1289 – Improper Validation of Unsafe Equivalence in Input

View all
CVE-2024-45179 HIGH POC
7.2
CVE-2024-45308 MEDIUM POC
6.5
CVE-2026-100255 CRITICAL
9.8
CVE-2022-0675 CRITICAL
9.8
CVE-2026-101015 MEDIUM POC
5.5
CVE-2026-97196 CRITICAL
9.1
CVE-2026-86831 HIGH
8.7
CVE-2026-102478 HIGH
8.7

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed

References

Advisories & patches
ADVISORY https://go.dev/issue/80481 ADVISORY https://go.dev/issue/80494 ADVISORY https://go.dev/issue/80744 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-39821 ADVISORY https://seclists.org/oss-sec/2026/q3/487 ADVISORY https://ubuntu.com/security/notices/USN-8900-1 ADVISORY https://vuldb.com/vuln/365210 REF https://access.redhat.com/errata/RHSA-2026:23262 REF https://access.redhat.com/errata/RHSA-2026:23264 REF https://access.redhat.com/errata/RHSA-2026:26546 REF https://access.redhat.com/errata/RHSA-2026:26547 REF https://access.redhat.com/errata/RHSA-2026:30650 REF https://access.redhat.com/errata/RHSA-2026:30651 REF https://access.redhat.com/errata/RHSA-2026:30853 REF https://access.redhat.com/errata/RHSA-2026:30854 REF https://access.redhat.com/errata/RHSA-2026:30855 REF https://access.redhat.com/errata/RHSA-2026:33155 REF https://access.redhat.com/errata/RHSA-2026:33160 REF https://access.redhat.com/errata/RHSA-2026:33163 REF https://access.redhat.com/errata/RHSA-2026:33173 REF https://access.redhat.com/errata/RHSA-2026:33183 REF https://access.redhat.com/errata/RHSA-2026:33524 REF https://access.redhat.com/errata/RHSA-2026:33531 REF https://access.redhat.com/errata/RHSA-2026:34342 REF https://access.redhat.com/errata/RHSA-2026:34357 REF https://access.redhat.com/errata/RHSA-2026:34359 REF https://access.redhat.com/errata/RHSA-2026:34364 REF https://access.redhat.com/errata/RHSA-2026:34789 REF https://access.redhat.com/errata/RHSA-2026:35826 REF https://access.redhat.com/errata/RHSA-2026:35827 REF https://access.redhat.com/errata/RHSA-2026:35828 REF https://access.redhat.com/errata/RHSA-2026:35829 REF https://access.redhat.com/errata/RHSA-2026:35830 REF https://access.redhat.com/errata/RHSA-2026:35831 REF https://access.redhat.com/errata/RHSA-2026:35993 REF https://access.redhat.com/errata/RHSA-2026:35994 REF https://access.redhat.com/errata/RHSA-2026:36105 REF https://access.redhat.com/errata/RHSA-2026:36167 REF https://access.redhat.com/errata/RHSA-2026:36207 REF https://access.redhat.com/errata/RHSA-2026:36648 REF https://access.redhat.com/errata/RHSA-2026:36651 REF https://access.redhat.com/errata/RHSA-2026:36796 REF https://access.redhat.com/errata/RHSA-2026:36797 REF https://access.redhat.com/errata/RHSA-2026:36808 REF https://access.redhat.com/errata/RHSA-2026:36820 REF https://access.redhat.com/errata/RHSA-2026:36883 REF https://access.redhat.com/errata/RHSA-2026:37387 REF https://access.redhat.com/errata/RHSA-2026:37435 REF https://access.redhat.com/errata/RHSA-2026:37436 REF https://access.redhat.com/errata/RHSA-2026:38995 REF https://access.redhat.com/errata/RHSA-2026:39005 REF https://access.redhat.com/errata/RHSA-2026:39573 REF https://access.redhat.com/errata/RHSA-2026:39879 REF https://access.redhat.com/errata/RHSA-2026:40118 REF https://access.redhat.com/errata/RHSA-2026:40119 REF https://access.redhat.com/errata/RHSA-2026:40262 REF https://access.redhat.com/errata/RHSA-2026:40945 REF https://access.redhat.com/errata/RHSA-2026:41019 REF https://access.redhat.com/errata/RHSA-2026:41030 REF https://access.redhat.com/errata/RHSA-2026:41031 REF https://access.redhat.com/errata/RHSA-2026:41036 REF https://access.redhat.com/errata/RHSA-2026:41055 REF https://access.redhat.com/errata/RHSA-2026:41066 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:41930 REF https://access.redhat.com/errata/RHSA-2026:42043 REF https://access.redhat.com/errata/RHSA-2026:42047 REF https://access.redhat.com/errata/RHSA-2026:42048 REF https://access.redhat.com/errata/RHSA-2026:42049 REF https://access.redhat.com/errata/RHSA-2026:42050 REF https://access.redhat.com/errata/RHSA-2026:42051 REF https://access.redhat.com/errata/RHSA-2026:42078 REF https://access.redhat.com/errata/RHSA-2026:42079 REF https://access.redhat.com/errata/RHSA-2026:42080 REF https://access.redhat.com/errata/RHSA-2026:42082 REF https://access.redhat.com/errata/RHSA-2026:42132 REF https://access.redhat.com/errata/RHSA-2026:42142 REF https://access.redhat.com/errata/RHSA-2026:42146 REF https://access.redhat.com/errata/RHSA-2026:42150 REF https://access.redhat.com/errata/RHSA-2026:42151 REF https://access.redhat.com/errata/RHSA-2026:42240 REF https://access.redhat.com/errata/RHSA-2026:42644 REF https://access.redhat.com/errata/RHSA-2026:42796 REF https://access.redhat.com/errata/RHSA-2026:42852 REF https://access.redhat.com/errata/RHSA-2026:43038 REF https://access.redhat.com/errata/RHSA-2026:43052 REF https://access.redhat.com/errata/RHSA-2026:43692 REF https://access.redhat.com/errata/RHSA-2026:44622 REF https://access.redhat.com/errata/RHSA-2026:44624 REF https://access.redhat.com/errata/RHSA-2026:46395 REF https://access.redhat.com/errata/RHSA-2026:47149 REF https://access.redhat.com/errata/RHSA-2026:47735 REF https://access.redhat.com/errata/RHSA-2026:47737 REF https://access.redhat.com/errata/RHSA-2026:47952 REF https://access.redhat.com/errata/RHSA-2026:49702 REF https://access.redhat.com/errata/RHSA-2026:49712 REF https://access.redhat.com/errata/RHSA-2026:50300 REF https://access.redhat.com/errata/RHSA-2026:50843 REF https://access.redhat.com/errata/RHSA-2026:51033 REF https://access.redhat.com/errata/RHSA-2026:51112 REF https://access.redhat.com/errata/RHSA-2026:51187 REF https://access.redhat.com/errata/RHSA-2026:51194 REF https://access.redhat.com/errata/RHSA-2026:51341 REF https://access.redhat.com/errata/RHSA-2026:52826 REF https://access.redhat.com/errata/RHSA-2026:53374 REF https://access.redhat.com/errata/RHSA-2026:53412 REF https://access.redhat.com/errata/RHSA-2026:53413 REF https://access.redhat.com/errata/RHSA-2026:53415 REF https://access.redhat.com/errata/RHSA-2026:53530 REF https://access.redhat.com/errata/RHSA-2026:54191 REF https://access.redhat.com/errata/RHSA-2026:54274 REF https://access.redhat.com/errata/RHSA-2026:54283 REF https://access.redhat.com/errata/RHSA-2026:54284 REF https://access.redhat.com/errata/RHSA-2026:54285 REF https://access.redhat.com/errata/RHSA-2026:54286 REF https://access.redhat.com/errata/RHSA-2026:54287 REF https://access.redhat.com/errata/RHSA-2026:54395 REF https://access.redhat.com/errata/RHSA-2026:54401 REF https://access.redhat.com/errata/RHSA-2026:54435 REF https://access.redhat.com/errata/RHSA-2026:54441 REF https://access.redhat.com/errata/RHSA-2026:54531 REF https://access.redhat.com/errata/RHSA-2026:54580 REF https://access.redhat.com/errata/RHSA-2026:54757 REF https://access.redhat.com/errata/RHSA-2026:56143 REF https://access.redhat.com/errata/RHSA-2026:56223 REF https://access.redhat.com/errata/RHSA-2026:56340 REF https://access.redhat.com/errata/RHSA-2026:56431 REF https://access.redhat.com/errata/RHSA-2026:57194 REF https://access.redhat.com/errata/RHSA-2026:57541 REF https://access.redhat.com/errata/RHSA-2026:57649 REF https://access.redhat.com/errata/RHSA-2026:57845 REF https://access.redhat.com/errata/RHSA-2026:59546 REF https://access.redhat.com/errata/RHSA-2026:59549 REF https://access.redhat.com/errata/RHSA-2026:59562 REF https://access.redhat.com/errata/RHSA-2026:60315 REF https://access.redhat.com/errata/RHSA-2026:60354 REF https://access.redhat.com/errata/RHSA-2026:60387 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:61245 REF https://access.redhat.com/errata/RHSA-2026:61253 REF https://access.redhat.com/errata/RHSA-2026:62549 REF https://access.redhat.com/errata/RHSA-2026:63134 REF https://access.redhat.com/errata/RHSA-2026:65126 REF https://access.redhat.com/errata/RHSA-2026:65153 REF https://access.redhat.com/errata/RHSA-2026:65359 REF https://access.redhat.com/errata/RHSA-2026:65534 REF https://access.redhat.com/errata/RHSA-2026:65851 REF https://access.redhat.com/errata/RHSA-2026:65886 REF https://access.redhat.com/errata/RHSA-2026:66016 REF https://access.redhat.com/errata/RHSA-2026:66022 REF https://access.redhat.com/errata/RHSA-2026:66350 REF https://access.redhat.com/errata/RHSA-2026:66432 REF https://access.redhat.com/errata/RHSA-2026:67149 REF https://access.redhat.com/errata/RHSA-2026:67159 REF https://access.redhat.com/errata/RHSA-2026:67160 REF https://access.redhat.com/errata/RHSA-2026:67287 REF https://access.redhat.com/errata/RHSA-2026:67319 REF https://access.redhat.com/errata/RHSA-2026:67517 REF https://access.redhat.com/errata/RHSA-2026:68504 REF https://access.redhat.com/security/cve/CVE-2026-39821 REF https://bugzilla.redhat.com/show_bug.cgi?id=2480756 REF https://go.dev/cl/767220 REF https://go.dev/issue/78760 REF https://groups.google.com/g/golang-announce/c/94pEornpRlI REF https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 REF https://pkg.go.dev/vuln/GO-2026-5026 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy