Summary
It was discovered that the Go x/net/idna package, vendored in Google Guest
Agent and Google OS Config Agent, incorrectly accepted Punycode-encoded
labels that decoded to ASCII-only labels when processing internationalized
domain names. A remote attacker could possibly use this issue to bypass
hostname-based access controls and escalate privileges.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | google-guest-agent | 20250116.00-0ubuntu1~22.04.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | google-osconfig-agent | 20251028.00-0ubuntu2~22.04.1 |
Vulnerabilities 1
-
Critical 9.6
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …
References
-
report
https://ubuntu.com/security/CVE-2026-39821