CVE-2026-39821 - Critical Severity Vulnerability
Vulnerable Library - golang.org/x/net-v0.47.0
Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.47.0.zip
Path to dependency file: /OPENAPI-REST-API/openapi-client/terraform-provider/go.mod
Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/golang.org/x/net/@v/v0.47.0.mod
Dependency Hierarchy:
- github.com/hashicorp/terraform-plugin-framework-v1.17.0 (Root Library)
- github.com/hashicorp/terraform-plugin-go-v0.29.0
- github.com/hashicorp/terraform-registry-address-v0.4.0
- ❌ golang.org/x/net-v0.47.0 (Vulnerable Library)
Found in HEAD commit: 1f70e2feccb7006c8d32cc7d4fe62f5cf5e5c34d
Found in base branch: master
Vulnerability Details
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Publish Date: 2026-05-22
URL: CVE-2026-39821
CVSS 3 Score Details (9.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://pkg.go.dev/vuln/GO-2026-5026
Release Date: 2026-05-22
Fix Resolution: golang.org/x/net - v0.55.0,https://github.com/golang/net.git - v0.55.0
Step up your Open Source Security Game with Mend here
CVE-2026-39821 - Critical Severity Vulnerability
Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.47.0.zip
Path to dependency file: /OPENAPI-REST-API/openapi-client/terraform-provider/go.mod
Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/golang.org/x/net/@v/v0.47.0.mod
Dependency Hierarchy:
Found in HEAD commit: 1f70e2feccb7006c8d32cc7d4fe62f5cf5e5c34d
Found in base branch: master
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Publish Date: 2026-05-22
URL: CVE-2026-39821
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://pkg.go.dev/vuln/GO-2026-5026
Release Date: 2026-05-22
Fix Resolution: golang.org/x/net - v0.55.0,https://github.com/golang/net.git - v0.55.0
Step up your Open Source Security Game with Mend here