9.6Kritik

CVE-2026-39821Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/idna; Red Hat Red Hat Ansible Automation Platform … Yayım: 2026-05-22 18:01 (5 ay önce)

Açıklama

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Zayıflık türü (CWE): CWE-1289

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
acm	2.11	—
acm	2.13	—
advanced cluster security	4.10	—
advanced cluster security	4.11	—
advanced cluster security	4.9	—
amq streams	3.2	—
ansible automation platform	2.5	—
ansible automation platform	2.6	—
ansible automation platform	2.7	—
cert manager	1.19	—
cluster observability operator	1.5	—
devworkspace	0.42	—
edge manager	1.0	—
edge manager	1.1	—
enterprise linux ai	3.4	—
Go standard library	net/http	< 1.25.13, 1.26.0-0 – < 1.26.6, 1.27.0-0 – < 1.27.0-rc.3
Go standard library	net/http/internal/http2	< 1.25.13, 1.26.0-0 – < 1.26.6, 1.27.0-0 – < 1.27.0-rc.3
golang	net	< 0.55.0
golang.org/x/net	golang.org/x/net/idna	< 0.55.0
lightspeed for runtimes	1.0	—
logging	6.0	—
logging	6.2	—
logging	6.4	—
logging	6.5	—
migration toolkit applications	8.1	—
migration toolkit applications	8.2	—
multicluster engine	2.11	—
multicluster engine	2.6	—
multicluster engine	2.8	—
multicluster engine	2.9	—
multicluster globalhub	1.4	—
multicluster globalhub	1.5	—
multicluster globalhub	1.6	—
multicluster globalhub	1.7	—
openshift	4.16	—
openshift	4.20	—
openshift	4.21	—
openshift	4.22	—
openshift ai	2.25	—
openshift ai	3.4	—
openshift api data protection	1.3	—
openshift api data protection	1.5	—
openshift api data protection	1.6	—
openshift builds	1.7	—
openshift builds	1.8	—
openshift data foundation	4.18	—
openshift data foundation	4.22	—
openshift devspaces	3.29	—
openshift distributed tracing	3.10	—
openshift gitops	1.19	—
openshift gitops	1.20	—
openstack	16.2	—
quay	3.10	—
quay	3.12	—
quay	3.15	—
quay	3.16	—
quay	3.17	—
quay	3.9	—
Red Hat	Cert Manager support for Red Hat OpenShift release 1.19	all versions
Red Hat	Cluster Observability Operator 1.5.0	all versions
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	all versions
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	all versions
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 10	all versions
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	all versions
Red Hat	Red Hat Ansible Automation Platform 2.7 for RHEL 10	all versions
Red Hat	Red Hat Ansible Automation Platform 2.7 for RHEL 9	all versions
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	all versions
Red Hat	Red Hat OpenShift Container Platform 4.16	all versions
Red Hat	Red Hat OpenShift Container Platform 4.20	all versions
Red Hat	Red Hat OpenShift Container Platform 4.21	all versions
Red Hat	Red Hat OpenShift Container Platform 4.22	all versions
Red Hat	Red Hat OpenStack Platform 16.2	all versions
Red Hat	Red Hat Satellite 6.16 for RHEL 8	all versions
Red Hat	Red Hat Satellite 6.16 for RHEL 9	all versions
Red Hat	Red Hat Satellite 6.17 for RHEL 9	all versions
Red Hat	Red Hat Satellite 6.18 for RHEL 9	all versions
Red Hat	Red Hat Satellite 6.19 for RHEL 9	all versions
Red Hat	RHEM 1.0 for RHEL 9	all versions
Red Hat	RHEM 1.1 for RHEL 10	all versions
Red Hat	RHEM 1.1 for RHEL 9	all versions
Red Hat	Streams for Apache Kafka 3.2.1	all versions
rhmt	1.8	—
satellite	6.16	—
satellite	6.17	—
satellite	6.18	—
satellite	6.19	—
service mesh	2.6	—
service mesh	3.0	—
service mesh	3.1	—
service mesh	3.2	—
service mesh	3.3	—
trusted artifact signer	1.4	—
webterminal	1.11	—
webterminal	1.12	—
webterminal	1.13	—
webterminal	1.14	—
webterminal	1.15	—
webterminal	1.16	—
workload availability far	0.8	—
workload availability mdr	0.7	—
workload availability nhc	0.12	—
workload availability nmo	5.7	—
workload availability sbr	0.3	—
workload availability snr	0.13	—

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (1)

cpe:2.3:a:golang:net:*:*:*:*:*:go:*:* < 0.55.0

CVSS puanı

9.6Kritik

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Düşük
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişir
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Tüm puanlar (4)

CISA-ADP	CVSS 3.1	9.6Kritik
redhat-SADP	CVSS 3.1	8.2Yüksek
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.6Kritik
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	8.2Yüksek

EPSS (30 günde istismar olasılığı)

1.83%

tüm CVE'lerin %79'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-04-07
Yayımlandı2026-05-22 18:01
IP-DB'ye ulaştı2026-10-24 23:50
Son güncelleme2026-09-17 15:18

Numarayı veren (CNA): Go
NVD durumu: Modified

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Go

Puansız

CVE-2026-97033 dün

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and …

Puansız

CVE-2026-97034 dün

Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Go toolchain cmd/go

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in l…

Puansız

CVE-2026-97054 dün

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …

Puansız

CVE-2026-97036 dün

Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Go toolchain cmd/go

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_librar…

Puansız

CVE-2026-97035 dün

Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

Go toolchain cmd/go

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the compiler and linker …

Puansız

CVE-2026-97037 dün

Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols"…