Summary
It was discovered that Go Networking incorrectly handled certain
Punycode-encoded labels in the idna package. An attacker could possibly use
this issue to bypass hostname-based access restrictions.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | golang-golang-x-net-dev | 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | golang-golang-x-net-dev | 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3 |
Vulnerabilities 1
-
Critical 9.6
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …
References
-
report
https://ubuntu.com/security/CVE-2026-39821