Summary
It was discovered that the Go x/net/idna package incorrectly handled
certain Punycode-encoded labels that decoded to ASCII-only labels. An
attacker could possibly use this issue to bypass hostname-based access
controls and escalate privileges.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | golang-1.24 | 1.24.13-2~22.04.2 |
Vulnerabilities 1
-
Critical 9.6
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …
References
-
report
https://ubuntu.com/security/CVE-2026-39821