by Kastro CVE-2026-39821
Go standard library net/http — Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Description · from the CVE record
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Affected
ProductAffectedFixed inSource
net/http< 1.25.131.25.13CNA
net/http1.26.0-0 – < 1.26.61.26.6CNA
net/http1.27.0-0 – < 1.27.0-rc.31.27.0-rc.3CNA
net/http/internal/http2< 1.25.131.25.13CNA
net/http/internal/http21.26.0-0 – < 1.26.61.26.6CNA
net/http/internal/http21.27.0-0 – < 1.27.0-rc.31.27.0-rc.3CNA
golang.org/x/net/idna< 0.55.00.55.0CNA
Red Hat Ansible Automation Platform 2.5 for RHEL 8see advisory0:1.6.6-1.el8apredhat-SADP
Red Hat Ansible Automation Platform 2.5 for RHEL 9see advisory0:1.6.6-1.el9apredhat-SADP
Red Hat Ansible Automation Platform 2.6 for RHEL 10see advisory0:1.6.6-1.el10apredhat-SADP
Red Hat Ansible Automation Platform 2.6 for RHEL 9see advisory0:1.6.6-1.el9apredhat-SADP
Red Hat Ansible Automation Platform 2.7 for RHEL 10see advisory0:1.6.6-1.el10apredhat-SADP
Scores by source
CISA ADP9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
redhat-SADP (CNA)8.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total