9.6
Critical
CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Description
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/net/idna 0.55 | earliest → < 0.55.0 | 0.55.0 |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 1784740143 | earliest → < 1784740143 | 1784740143 |
| Red Hat Advanced Cluster Security for Kubernetes 4.10 1781686458 | earliest → < 1781686458 | 1781686458 |
| Red Hat Advanced Cluster Security for Kubernetes 4.9 1781686446 | earliest → < 1781686446 | 1781686446 |
| Red Hat Hardened Images | Versions not published | |
| Red Hat OpenShift Service Mesh 2.6 1782287580 | earliest → < 1782287580 | 1782287580 |
Show the 197 other branches Hide the 197 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Service Mesh 3.0 1782201833 | earliest → < 1782201833 | 1782201833 |
| Red Hat OpenShift Service Mesh 3.1 1782201537 | earliest → < 1782201537 | 1782201537 |
| Red Hat OpenShift Service Mesh 3.2 1782201812 | earliest → < 1782201812 | 1782201812 |
| Red Hat OpenShift Service Mesh 3.3 1782201466 | earliest → < 1782201466 | 1782201466 |
| multicluster engine for Kubernetes 2.8 1784306906 | earliest → < 1784306906 | 1784306906 |
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Versions not published | |
| Builds for Red Hat OpenShift | Versions not published | |
| cert-manager Operator for Red Hat OpenShift | Versions not published | |
| Compliance Operator | Versions not published | |
| Confidential Compute Attestation | Versions not published | |
| Cryostat 4 | Versions not published | |
| Deployment Validation Operator | Versions not published | |
| External Secrets Operator for Red Hat OpenShift | Versions not published | |
| Fence Agents Remediation Operator | Versions not published | |
| File Integrity Operator | Versions not published | |
| Gatekeeper 3 | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Logical Volume Manager Storage | Versions not published | |
| Machine Deletion Remediation Operator | Versions not published | |
| Migration Toolkit for Applications 8 | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| Multiarch Tuning Operator | Versions not published | |
| Multicluster Engine for Kubernetes | Versions not published | |
| Multicluster Global Hub | Versions not published | |
| Network Observability Operator | Versions not published | |
| Node HealthCheck Operator | Versions not published | |
| OpenShift API for Data Protection | Versions not published | |
| OpenShift Developer Tools and Services | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Power monitoring for Red Hat OpenShift | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Ceph Storage 5 | Versions not published | |
| Red Hat Ceph Storage 6 | Versions not published | |
| Red Hat Ceph Storage 8 | Versions not published | |
| Red Hat Ceph Storage 9 | Versions not published | |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Connectivity Link 1 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Edge Manager 1 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat Lightspeed for Runtimes Operator | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Cluster Manager CLI | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat OpenShift Dev Workspaces Operator | Versions not published | |
| Red Hat OpenShift for Windows Containers | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat OpenShift on AWS | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat OpenStack Platform 16.2 | Versions not published | |
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| Red Hat Web Terminal | Versions not published | |
| Security Profiles Operator | Versions not published | |
| streams for Apache Kafka 3 | Versions not published | |
| Zero Trust Workload Identity Manager | Versions not published | |
| Zero Trust Workload Identity Manager - Tech Preview | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat Service Interconnect 1 | Versions not published | |
| Red Hat Service Interconnect 2 | Versions not published | |
| Red Hat Enterprise Linux AI 3.4 1782744830 | earliest → < 1782744830 | 1782744830 |
| Cluster Observability Operator 1.5.0 1782838476 | earliest → < 1782838476 | 1782838476 |
| Logging Subsystem for Red Hat OpenShift 6.4 1782408807 | earliest → < 1782408807 | 1782408807 |
| Red Hat OpenShift Container Platform 4.22 | Versions not published | |
| Red Hat OpenShift GitOps 1.19 1782292352 | earliest → < 1782292352 | 1782292352 |
| Red Hat OpenShift GitOps 1.20 1782383826 | earliest → < 1782383826 | 1782383826 |
| multicluster engine for Kubernetes 2.6 1783985999 | earliest → < 1783985999 | 1783985999 |
| Red Hat Advanced Cluster Security for Kubernetes 4.11 1783352589 | earliest → < 1783352589 | 1783352589 |
| Red Hat OpenShift Builds 1.7.4 1783057868 | earliest → < 1783057868 | 1783057868 |
| RHEM 1.0 for RHEL 9 | Versions not published | |
| DevWorkspace Operator 0.42 1782401674 | earliest → < 1782401674 | 1782401674 |
| Red Hat Edge Manager 1.0 1783502438 | earliest → < 1783502438 | 1783502438 |
| Red Hat OpenShift Dev Spaces 3.29 1782991491 | earliest → < 1782991491 | 1782991491 |
| Red Hat Trusted Artifact Signer 1.4 4 | earliest → < 4-1.4.2 | 4-1.4.2 |
| multicluster engine for Kubernetes 2.9 1783260894 | earliest → < 1783260894 | 1783260894 |
| Red Hat OpenShift Service Mesh 3 1782201833 | earliest → < 1782201833 | 1782201833 |
| Red Hat Openshift Data Foundation 4.22 1782934284 | earliest → < 1782934284 | 1782934284 |
| Red Hat Edge Manager 1.1 1784127736 | earliest → < 1784127736 | 1784127736 |
| Red Hat Quay 3.9 1784125838 | earliest → < 1784125838 | 1784125838 |
| RHEM 1.1 for RHEL 10 | Versions not published | |
| RHEM 1.1 for RHEL 9 | Versions not published | |
| Multicluster Global Hub 1.4.5 1784061472 | earliest → < 1784061472 | 1784061472 |
| Red Hat OpenShift Builds 1.8.1 1783612119 | earliest → < 1783612119 | 1783612119 |
| Red Hat Quay 3.10 1783750447 | earliest → < 1783750447 | 1783750447 |
| Red Hat Quay 3.16 1783955846 | earliest → < 1783955846 | 1783955846 |
| Red Hat Advanced Cluster Security 4.9 1781686446 | earliest → < 1781686446 | 1781686446 |
| Red Hat multicluster global hub 1.4.3 1784061472 | earliest → < 1784061472 | 1784061472 |
| Red Hat OpenShift Builds 1.7.1 1783057868 | earliest → < 1783057868 | 1783057868 |
| Red Hat OpenShift GitOps 1.2 1782383826 | earliest → < 1782383826 | 1782383826 |
| Red Hat Quay 3.1 1783750447 | earliest → < 1783750447 | 1783750447 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.7 for RHEL 10 | Versions not published | |
| Red Hat Ansible Automation Platform 2.7 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.16 for RHEL 8 | Versions not published | |
| Red Hat Satellite 6.16 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.17 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.18 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.19 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 1783962464 | earliest → < 1783962464 | 1783962464 |
| Red Hat Ansible Automation Platform 2.7 1783917963 | earliest → < 1783917963 | 1783917963 |
| Red Hat Migration Toolkit 1.8 1783953372 | earliest → < 1783953372 | 1783953372 |
| Red Hat OpenShift AI 2.25 1787330073 | earliest → < 1787330073 | 1787330073 |
| Red Hat Quay 3.12 1784353904 | earliest → < 1784353904 | 1784353904 |
| Red Hat Quay 3.12 1783751865 | earliest → < 1783751865 | 1783751865 |
| Red Hat Web Terminal 1.11 1784296203 | earliest → < 1784296203 | 1784296203 |
| Red Hat Web Terminal 1.12 1784247610 | earliest → < 1784247610 | 1784247610 |
| Red Hat Web Terminal 1.13 1784296127 | earliest → < 1784296127 | 1784296127 |
| Red Hat Web Terminal 1.14 1784296114 | earliest → < 1784296114 | 1784296114 |
| Red Hat Web Terminal 1.15 1784296033 | earliest → < 1784296033 | 1784296033 |
| Red Hat Web Terminal 1.16 1784295767 | earliest → < 1784295767 | 1784295767 |
| Multicluster Global Hub 1.5.6 1784127491 | earliest → < 1784127491 | 1784127491 |
| Red Hat Migration Toolkit for Applications 8.2 1784211378 | earliest → < 1784211378 | 1784211378 |
| Red Hat Quay 3.15 1784351966 | earliest → < 1784351966 | 1784351966 |
| OpenShift API for Data Protection 1.6 1784058822 | earliest → < 1784058822 | 1784058822 |
| Red Hat OpenShift distributed tracing 3.10.2 1784775782 | earliest → < 1784775782 | 1784775782 |
| Multicluster Global Hub 1.6.4 1784152046 | earliest → < 1784152046 | 1784152046 |
| Logging for Red Hat OpenShift 6.4 1782408807 | earliest → < 1782408807 | 1782408807 |
| multicluster engine for Kubernetes 2.9.0 1783260894 | earliest → < 1783260894 | 1783260894 |
| Multicluster Global Hub 1.6.2 1784152046 | earliest → < 1784152046 | 1784152046 |
| Red Hat multicluster global hub 1.5.0 1784127491 | earliest → < 1784127491 | 1784127491 |
| Red Hat OpenShift Builds 1.8.0 1783612119 | earliest → < 1783612119 | 1783612119 |
| Red Hat OpenShift distributed tracing 3.10.0 1784775782 | earliest → < 1784775782 | 1784775782 |
| Multicluster Global Hub 1.7.2 1785775948 | earliest → < 1785775948 | 1785775948 |
| Multicluster Global Hub 1.7.2 1784768332 | earliest → < 1784768332 | 1784768332 |
| Logging Subsystem for Red Hat OpenShift 6.2 1784747813 | earliest → < 1784747813 | 1784747813 |
| Multicluster Global Hub 1.5.4 1784127491 | earliest → < 1784127491 | 1784127491 |
| Multicluster Global Hub 1.7.0 1785775948 | earliest → < 1785775948 | 1785775948 |
| Multicluster Global Hub 1.7.0 1784768332 | earliest → < 1784768332 | 1784768332 |
| Red Hat multicluster global hub 1.4.2 1784061472 | earliest → < 1784061472 | 1784061472 |
| Red Hat multicluster global hub 1.6.0 1784152046 | earliest → < 1784152046 | 1784152046 |
| Logging for Red Hat OpenShift 6.2 1784747813 | earliest → < 1784747813 | 1784747813 |
| Multicluster Global Hub 1.7.1 1784768332 | earliest → < 1784768332 | 1784768332 |
| Red Hat multicluster global hub 1.4.4 1784061472 | earliest → < 1784061472 | 1784061472 |
| Red Hat OpenShift Builds 1.7.3 1783057868 | earliest → < 1783057868 | 1783057868 |
| Red Hat Migration Toolkit for Applications 8.1 1785171639 | earliest → < 1785171639 | 1785171639 |
| Red Hat OpenShift distributed tracing 3.10.1 1784775782 | earliest → < 1784775782 | 1784775782 |
| Logging Subsystem for Red Hat OpenShift 6.0 1785418851 | earliest → < 1785418851 | 1785418851 |
| OpenShift API for Data Protection 1.3 1785180878 | earliest → < 1785180878 | 1785180878 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published | |
| Red Hat Satellite 6.18 1785923308 | earliest → < 1785923308 | 1785923308 |
| Red Hat Satellite 6.19 1785929994 | earliest → < 1785929994 | 1785929994 |
| Logging for Red Hat OpenShift 6.0 1785418851 | earliest → < 1785418851 | 1785418851 |
| Node Maintenance Operator | Versions not published | |
| Self Node Remediation Operator | Versions not published | |
| Storage-Based Remediation | Versions not published | |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | Versions not published | |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | Versions not published | |
| Red Hat OpenShift Workload Availability 0.12 1785202723 | earliest → < 1785202723 | 1785202723 |
| Red Hat OpenShift Workload Availability 0.7 1785203508 | earliest → < 1785203508 | 1785203508 |
| Red Hat OpenShift Workload Availability 5.7 1785202847 | earliest → < 1785202847 | 1785202847 |
| net/http 1.27 | earliest → < 1.27.0-rc.3 | 1.27.0-rc.3 |
| net/http 1.26 | 1.26.0-0 → < 1.26.6 | 1.26.6 |
| net/http 1.25 | earliest → < 1.25.13 | 1.25.13 |
| net/http/internal/http2 1.27 | earliest → < 1.27.0-rc.3 | 1.27.0-rc.3 |
| net/http/internal/http2 1.26 | 1.26.0-0 → < 1.26.6 | 1.26.6 |
| net/http/internal/http2 1.25 | earliest → < 1.25.13 | 1.25.13 |
| Streams for Apache Kafka 3.2.1 | Versions not published | |
| Cert Manager support for Red Hat OpenShift release 1.19 1786613805 | earliest → < 1786613805 | 1786613805 |
| Multicluster Global Hub 1.5.7 1784127491 | earliest → < 1784127491 | 1784127491 |
| Multicluster Global Hub 1.6.5 1784152046 | earliest → < 1784152046 | 1784152046 |
| Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 1786483782 | earliest → < 1786483782 | 1786483782 |
| Red Hat OpenShift Workload Availability 0.13 1785203036 | earliest → < 1785203036 | 1785203036 |
| Red Hat OpenShift Workload Availability 0.3 1785203474 | earliest → < 1785203474 | 1785203474 |
| Red Hat OpenShift Workload Availability 0.8 1785203079 | earliest → < 1785203079 | 1785203079 |
| Red Hat Quay 3.17 1786181981 | earliest → < 1786181981 | 1786181981 |
| Red Hat Migration Toolkit for Containers 1.8 1783953372 | earliest → < 1783953372 | 1783953372 |
| Red Hat multicluster global hub 1.5.1 1784127491 | earliest → < 1784127491 | 1784127491 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | Versions not published | |
| Red Hat OpenShift Container Platform 4.16 416.94 | earliest → < 416.94.202609011112-0 | 416.94.202609011112-0 |
| Red Hat OpenShift Container Platform 4.20 | Versions not published | |
| Logging Subsystem for Red Hat OpenShift 6.5 1786645107 | earliest → < 1786645107 | 1786645107 |
| multicluster engine for Kubernetes 2.11 1786912006 | earliest → < 1786912006 | 1786912006 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 1787685239 | earliest → < 1787685239 | 1787685239 |
| Red Hat OpenShift AI 3.4 1787361677 | earliest → < 1787361677 | 1787361677 |
| Red Hat Openshift Data Foundation 4.18 1786706880 | earliest → < 1786706880 | 1786706880 |
| ExternalDNS Operator | Versions not published | |
| Red Hat multicluster global hub 1.5.3 1784127491 | earliest → < 1784127491 | 1784127491 |
| Logging for Red Hat OpenShift 6 1785418851 | earliest → < 1785418851 | 1785418851 |
| Red Hat OpenShift distributed tracing 3 | Versions not published | |
| OpenShift API for Data Protection 1.5 1788860461 | earliest → < 1788860461 | 1788860461 |
| Red Hat OpenShift Container Platform 4.21 | Versions not published |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified