The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only…

CVE-2026-39821 is a hostname-validation bypass in Go's golang.org/x/net/idna package and the standard library net/http. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to pure ASCII — for example, ToUnicode("xn--example-.com") silently returns "example.com" instead of an error. Any Go application that performs authorization or routing decisions on a raw hostname string *before* IDNA normalization can be tricked: the attacker supplies a Punycode alias that passes the ASCII allowlist/blocklist, and after conversion the request targets the restricted hostname the application meant to deny. Affected versions span every release of golang.org/x/net before v0.55.0, Go standard library before go1.25.13 / go1.26.6 / go1.27.0-rc.3, and every statically-linked binary or container image built with an older toolchain.

The vendor-assigned CVSS 9.6 (CRITICAL) overstates real-world exploitability. The NVD vector uses AC:L (low attack complexity), but exploitation is not a one-shot remote attack — it demands that the target application follow a specific code pattern: hostname-based security check → accept Punycode input → normalize via idna.ToUnicode → use the normalized output for the actual access decision. Red Hat independently reassessed this at 8.2 / Important with AC:H, acknowledging the conditional nature. There is no public proof-of-concept, no KEV listing, no observed exploitation in the wild, and the EPSS probability sits at 0.69% (51st percentile). The bug matters most for Kubernetes ingress controllers, reverse proxies, and SSRF-protection layers — all of which perform hostname routing — and those high-value roles keep the floor firmly at HIGH. For a typical Go microservice that never branches on hostnames, the exploitability drops to near zero.

1. Normalize hostnames before security checks in application code — If your Go application performs hostname-based authorization, call idna.ToUnicode() or idna.ToASCII() *before* the allowlist/blocklist check, not after. This eliminates the check-then-normalize anti-pattern regardless of the library version. This is a code change, not a config change — deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Reject Punycode labels at the WAF or ingress tier — Add WAF rules (ModSecurity, Cloudflare, AWS WAF) to block or flag HTTP requests containing xn-- prefixed hostname labels in Host headers, SNI, or URL paths. This catches the bypass vector at the perimeter before it reaches vulnerable application logic. Deploy within 30 days.
3. Rebuild all Go binaries and container images with go1.26.6+ or golang.org/x/net v0.55.0+ — Every statically-linked Go binary and container image must be recompiled — a service restart alone does NOT apply the fix. Prioritize ingress controllers, API gateways, and reverse proxies. Use govulncheck to identify affected binaries. Complete within 180 days per the noisgate remediation SLA for HIGH.
4. Run govulncheck across your Go SBOM — Execute govulncheck ./... in every Go module repository and against container images using govulncheck -mode=binary <binary>. This identifies whether the vulnerable idna functions are actually *called* in your code (reachability analysis), not just imported. Prioritize remediation for binaries where the vulnerable call path is reachable.
5. Enforce service mesh hostname policies independently — If running Istio, Linkerd, or similar service mesh, configure AuthorizationPolicy resources that enforce hostname restrictions at the sidecar proxy level, independent of the application's own hostname checks. This provides defense-in-depth against application-level hostname bypass.

Run this script on any host where Go binaries or container images are deployed. It checks whether the installed golang.org/x/net module version is vulnerable. Requires go toolchain for source checks or govulncheck for binary analysis. Example: chmod +x check_cve_2026_39821.sh && ./check_cve_2026_39821.sh /path/to/go/module or ./check_cve_2026_39821.sh --binary /path/to/binary. No special privileges required.

#!/usr/bin/env bash
# check_cve_2026_39821.sh — Detect CVE-2026-39821 in Go modules or binaries
# Usage:
#   ./check_cve_2026_39821.sh /path/to/go/module       (source mode)
#   ./check_cve_2026_39821.sh --binary /path/to/binary  (binary mode)
#
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

FIXED_VERSION="v0.55.0"
CVE="CVE-2026-39821"

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

# Binary mode
if [[ "${1:-}" == "--binary" ]]; then
  BINARY="${2:-}"
  if [[ -z "$BINARY" || ! -f "$BINARY" ]]; then
    echo "UNKNOWN — binary path not provided or not found"
    exit 2
  fi
  if command -v govulncheck &>/dev/null; then
    echo "[*] Running govulncheck in binary mode against $BINARY ..."
    if govulncheck -mode=binary "$BINARY" 2>&1 | grep -q "$CVE"; then
      echo "VULNERABLE — govulncheck confirmed $CVE in $BINARY"
      exit 1
    else
      echo "PATCHED — govulncheck did not find $CVE in $BINARY"
      exit 0
    fi
  else
    # Fallback: check embedded module version via go version -m
    if ! command -v go &>/dev/null; then
      echo "UNKNOWN — neither govulncheck nor go toolchain found"
      exit 2
    fi
    MOD_VER=$(go version -m "$BINARY" 2>/dev/null | grep 'golang.org/x/net' | awk '{print $3}' | head -1)
    if [[ -z "$MOD_VER" ]]; then
      echo "UNKNOWN — golang.org/x/net not found in binary module info"
      exit 2
    fi
    if version_gte "$MOD_VER" "$FIXED_VERSION"; then
      echo "PATCHED — $BINARY embeds golang.org/x/net $MOD_VER (>= $FIXED_VERSION)"
      exit 0
    else
      echo "VULNERABLE — $BINARY embeds golang.org/x/net $MOD_VER (< $FIXED_VERSION)"
      exit 1
    fi
  fi
fi

# Source / module mode
MOD_DIR="${1:-$(pwd)}"
if [[ ! -f "$MOD_DIR/go.sum" ]]; then
  echo "UNKNOWN — no go.sum found in $MOD_DIR"
  exit 2
fi

MOD_VER=$(grep 'golang.org/x/net ' "$MOD_DIR/go.sum" | head -1 | awk '{print $2}' | sed 's|/go.mod||')
if [[ -z "$MOD_VER" ]]; then
  echo "UNKNOWN — golang.org/x/net not found in go.sum"
  exit 2
fi

if version_gte "$MOD_VER" "$FIXED_VERSION"; then
  echo "PATCHED — golang.org/x/net $MOD_VER (>= $FIXED_VERSION)"
  exit 0
else
  echo "VULNERABLE — golang.org/x/net $MOD_VER (< $FIXED_VERSION)"
  exit 1
fi

1. Go Vulnerability Database — GO-2026-5026
2. GitHub Advisory — GHSA-w2q5-6q6x-x959
3. Go Issue #78760 — ToUnicode accepts ASCII-only Punycode labels
4. Red Hat CVE-2026-39821 Advisory
5. NVD — CVE-2026-39821
6. Kubernetes Issue #140092 — kubectl ships vulnerable golang.org/x/net
7. Go CL 767220 — Fix for IDNA Punycode validation
8. CWE-1289 — Improper Validation of Unsafe Equivalence in Input