CVE-2026-39821
highEPSS 0.007 · 52 %ileCHDEEUFRRUUSEPSS · scored 2026-10-18
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedLabX Enterprisemettler_toledo_psirt
Update to LabX Enterprise v21.4.25 to address the vulnerability.
- FixedLabX Standardmettler_toledo_psirt
Update to LabX Standard v21.4.25 to address the vulnerability.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.2–9.6
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (193)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux Advanced Cluster Management for Kubernetesall versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_management_for_kubernetes
- Red Hat Enterprise Linux Advanced Cluster Securityall versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security
- Red Hat Enterprise Linux Edge Managerall versionscert_bundDEcpe:/o:redhat:enterprise_linux:edge_manager
- Red Hat Enterprise Linux Migration Toolkit for Applicationsall versionscert_bundDEcpe:/o:redhat:enterprise_linux:migration_toolkit_for_applications_6.2.0
- Red Hat Enterprise Linux Multicluster Engine for Kubernetesall versionscert_bundDEcpe:/o:redhat:enterprise_linux:multicluster_engine_for_kubernetes
- Red Hat OpenShift API for Data Protectionall versionscert_bundDEcpe:/a:redhat:openshift:api_for_data_protection
- Red Hat OpenShift Container Platformall versionscert_bundDEcpe:/a:redhat:openshift:container_platform
- Red Hat OpenShift Container Platform 4.22.4all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.22.4
advisories (6)
Vendor and ecosystem advisories describing this.
- VDE-2026-088METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.42026-08-20csaf · mettler_toledo_psirtCH
The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25. The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25 All other vulnerabilities are to be fixed in the upcoming releases.
- WID-SEC-W-2026-1653Golang Go-Module (Net, Image, Crypto: Mehrere SchwachstellenDeutsch2026-05-21csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um erweiterte Privilegien zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2026-2455Oracle Solaris Drittanbieterkomponenten: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2026-2850Golang Go: Mehrere SchwachstellenDeutsch2026-08-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service zu verursachen, ein Cross Site Scripting durchzuführen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren.
- CERTFR-2026-AVI-1333Multiples vulnérabilités dans le noyau Linux d'UbuntuFrançais2026-10-16vendor · certfrFR
- GO-2026-5026Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna2026-05-22vendor · osvUS
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (170)
External citations — patches, advisories, analysis.
- https://go.dev/cl/767220cnnvd
- https://go.dev/doc/installPatchcnnvd
- https://go.dev/issue/78760cnnvd
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8cnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-39821cnnvd
- https://pkg.go.dev/vuln/GO-2026-5026cnnvd
- https://go.dev/cl/767220enisa_euvd
- https://go.dev/issue/78760enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan