Skip to main content
Version: v1.2.x

CVE-2026-39821

CVE Details

Visit the official vulnerability details page for CVE-2026-39821 to learn more.

Initial Publication

05/22/2026

Last Update

08/06/2026

Third Party Dependency

golang.org/x/net

NIST CVE Summary

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

CVE Severity

9.6

Our Official Summary

Investigation is ongoing to determine how this vulnerability affects our products.

Status

Modified

Affected Products & Versions

VersionPaletteAIPaletteAI VerteX
1.2.1⚠️ Impacted⚠️ Impacted
1.1.8⚠️ Impacted⚠️ Impacted

Revision History

No revisions available.