golang.org/x/net/idna vulnerabilities

1 known vulnerability in golang.org/x/net/idna from Golang.org/x/net. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  net/http: Improper Validation of Unsafe Equivalence in Input

  CVE-2026-39821May 22, 2026Go standard libraryEPSS 1.83%

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege e