Repository navigation
net/http, x/net/idna: ToUnicode accepts Punycode labels encoding pure ASCII labelsΒ #78760
Description
The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels
that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")
incorrectly returned the name "example.com" rather than an error.
The idna package implements the processing algorithm from UTS 46.
Older versions of UTS 46 included a specification bug which permitted
multiple ASCII labels to decode to the same Unicode label.
UTS 46 revision 33 fixed the specification bug.
The idna package now implements the updated specification.
This behavior can lead to privilege escalation in programs using the idna package.
For example, a program which performs privilege checks on the ASCII hostname
may reject "example.com" but permit "xn--example-.com". If that program subsequently
converts the ASCII hostname to Unicode, it will inadvertently permits access
to the Unicode name "example.com".
Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.
This was a PUBLIC track issue, tracked in http://b/500342011.
Activity
gopherbot commentedon Apr 15, 2026
Change https://go.dev/cl/767220 mentions this issue:
idna: update from x/text, fix ToUnicode and all-ASCII xn-- labelsgabyhelp commentedon Apr 15, 2026
Related Issues
(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)
neild commentedon Apr 15, 2026
Thanks to @KC1zs4 for reporting this issue.
idna: update from x/text, fix ToUnicode and all-ASCII xn-- labels
upgraded golang.org/x/net v0.53.0 => v0.55.0
upgraded golang.org/x/net v0.53.0 => v0.55.0
Upgrade `golang.org/x/` dependencies to address vulnerabilities (#311)
CVE-2026-39821: idna: update from x/text, fix ToUnicode and all-ASCIIβ¦
19 remaining items
gopherbot commentedon Jul 10, 2026
Change https://go.dev/cl/799120 mentions this issue:
[release-branch.go1.26] all: update x/netgopherbot commentedon Jul 10, 2026
Change https://go.dev/cl/799121 mentions this issue:
[release-branch.go1.25] all: update x/net[release-branch.go1.25] all: update x/net
[release-branch.go1.26] all: update x/net
Auto-update 2026-07-12, 06:08 UTC: MATERIAL cycle (31st in row) β 3 xβ¦
idna: reject all-ASCII xn-- labels on all Go versions
idna: reject all-ASCII xn-- labels on all Go versions
idna: reject all-ASCII xn-- labels on all Go versions
dmitshur commentedon Aug 10, 2026
@neild Just to confirm, there's nothing actually left to change in the Go 1.27 and newer toolchains, is that right? Backport issues #80298 and #80297 track the older toolchain backports. (Adding a release blocker so this isn't missed.)
cipherboy commentedon Aug 11, 2026
@neild @dmitshur @cagedmantis This issue's description does not articulate the breakage mentioned in #80476 (error parsing trailing dots), though ostensibly probably is in scope as part of this CVE. Can you add that to the changelogs as well, please, before back porting?
I was surprised at this behavior on 1.27rc2 without a corresponding release note. OpenBao and Vault both have test cases which rely on this behavior, which suggests a customer somewhere wanted it. I'm fine breaking it, would just like something in Go I can point to and right now #80476 as an unresponded, open issue isn't a great place to point whether this is intentional or not.
Thanks!
[-]x/net/idna: ToUnicode accepts Punycode labels encoding pure ASCII labels[/-][+]net/http, x/net/idna: ToUnicode accepts Punycode labels encoding pure ASCII labels[/+]jub0bs commentedon Aug 14, 2026
@thatnealpatel Just to reiterate @cipherboy's comment, I believe that the fix for this is causing #80476, which hasn't received much attention so far. In that sense, I'm not sure whether this issue deserves to be closed as "completed".
I would attempt to fix #80476 myself if only I had enough time to do so.