THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-39821 (CRITICAL 9.6) — The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program

[NVD] CVE-2026-39821 (CRITICAL 9.6) — The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program

lownvdPublished 2026-05-22

CVE-2026-39821 CVSS: 9.6 CRITICAL Published: 2026-05-22T16:16:20.410

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program w

Indicators of compromise

CVE-2026-39821cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-39821