Към съдържанието
Търсене

CVE-2026-39821: Go standard library net/http, невалидиран вход

9.6

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Засегнати продукти

  • Go standard library net/http: преди 1.25.13; 1.26.0-0 преди 1.26.6; 1.27.0-0 преди 1.27.0-rc.3
  • Go standard library net/http/internal/http2: преди 1.25.13; 1.26.0-0 преди 1.26.6; 1.27.0-0 преди 1.27.0-rc.3
  • golang.org/x/net golang.org/x/net/idna: преди 0.55.0
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8: 0:1.6.6-1.el8ap преди *
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9: 0:1.6.6-1.el9ap преди *
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 10: 0:1.6.6-1.el10ap преди *
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9: 0:1.6.6-1.el9ap преди *
  • Red Hat Red Hat Ansible Automation Platform 2.7 for RHEL 10: 0:1.6.6-1.el10ap преди *
  • Red Hat Red Hat Ansible Automation Platform 2.7 for RHEL 9: 0:1.6.6-1.el9ap преди *
  • Red Hat Red Hat Enterprise Linux 10: 0:3.7.1-5.el10_2.5 преди *
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: 0:1.26.5-1.el10_0 преди *
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support: 0:0.11-1.el7_9 преди *
  • Red Hat Red Hat Enterprise Linux 8: 0:3.4.1-11.el8_10 преди *
  • Red Hat Red Hat Enterprise Linux 9: 0:3.7.1-4.el9_8.1 преди *
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: 1:0.2.2-1.el9_2.4 преди *
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: 0:0.152.1-1.el9_4 преди *
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: 0:1.26.5-1.el9_6 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.16: 0:4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.20: 0:4.20.0-202608101541.p2.g1367d50.assembly.stream.el8 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.21: 0:4.21.0-202609021357.p2.g83d4961.assembly.stream.el10 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.22: 0:4.22.0-202606291123.p2.ga17a3e3.assembly.stream.el8 преди *
  • Red Hat Red Hat OpenStack Platform 16.2: 0:3.3.23-22.el8ost преди *
  • Red Hat Red Hat Satellite 6.16 for RHEL 8: 0:0.0.4-1.el8sat преди *
  • Red Hat Red Hat Satellite 6.16 for RHEL 9: 0:0.0.4-1.el9sat преди *
  • Red Hat Red Hat Satellite 6.17 for RHEL 9: 0:0.0.4-1.el9sat преди *
  • Red Hat Red Hat Satellite 6.18 for RHEL 9: 0:0.0.4-1.el9sat преди *
  • Red Hat Red Hat Satellite 6.19 for RHEL 9: 0:0.0.4-1.el9sat преди *
  • Red Hat RHEM 1.0 for RHEL 9: 0:1.0.3-1.el9em преди *
  • Red Hat RHEM 1.1 for RHEL 10: 0:1.1.3-1.el10em преди *
  • Red Hat RHEM 1.1 for RHEL 9: 0:1.1.3-1.el9em преди *
  • Red Hat Streams for Apache Kafka 3.2.1: danielqsj-kafka_exporter преди *
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19: 1786613805 преди *
  • Red Hat Cluster Observability Operator 1.5.0: 1782840519 преди *
  • Red Hat DevWorkspace Operator 0.42: 1782401674 преди *
  • Red Hat Logging for Red Hat OpenShift 6: 1785418851 преди *
  • Red Hat Logging for Red Hat OpenShift 6.2: 1784747813 преди *
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.4: 1782408807 преди *
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.5: 1786645107 преди *
  • Red Hat multicluster engine for Kubernetes 2.11: 1786912006 преди *
  • Red Hat multicluster engine for Kubernetes 2.6: 1783332008 преди *
  • Red Hat multicluster engine for Kubernetes 2.8: 1782477094 преди *
  • Red Hat multicluster engine for Kubernetes 2.9: 1783260894 преди *
  • Red Hat Multicluster Global Hub 1.4.5: 1784061472 преди *
  • Red Hat Multicluster Global Hub 1.6.5: 1784152046 преди *
  • Red Hat Multicluster Global Hub 1.7.0: 1784768332 преди *; 1785775948 преди *
  • Red Hat OpenShift API for Data Protection 1.3: 1785180878 преди *
  • Red Hat OpenShift API for Data Protection 1.5: 1788860461 преди *
  • Red Hat OpenShift API for Data Protection 1.6: 1784058822 преди *
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11: 1787685239 преди *
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13: 1782383730 преди *
  • Red Hat Red Hat Advanced Cluster Security 4.9: 1781686446 преди *
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10: 1781686458 преди *
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.11: 1783352589 преди *
  • Red Hat Red Hat Ansible Automation Platform 2.6: 1783962464 преди *
  • Red Hat Red Hat Ansible Automation Platform 2.7: 1783917963 преди *
  • Red Hat Red Hat Edge Manager 1.0: 1783502438 преди *
  • Red Hat Red Hat Edge Manager 1.1: 1784194574 преди *
  • Red Hat Red Hat Enterprise Linux AI 3.4: 1782804957 преди *
  • Red Hat Red Hat Hardened Images: 1.25.11-2.hum1 преди *
  • Red Hat Red Hat Lightspeed (formerly Insights) for Runtimes 1.0: 1786483782 преди *
  • Red Hat Red Hat Migration Toolkit 1.8: 1783953372 преди *
  • Red Hat Red Hat Migration Toolkit for Applications 8.1: 1785171639 преди *
  • Red Hat Red Hat Migration Toolkit for Applications 8.2: 1784211378 преди *
  • Red Hat Red Hat multicluster global hub 1.5.3: 1784127491 преди *
  • Red Hat Red Hat OpenShift AI 2.25: 1783544461 преди *
  • Red Hat Red Hat OpenShift AI 3.4: 1787051722 преди *
  • Red Hat Red Hat OpenShift Builds 1.7.3: 1783057515 преди *
  • Red Hat Red Hat OpenShift Builds 1.8.1: 1784121108 преди *
  • Red Hat Red Hat Openshift Data Foundation 4.18: 1786705347 преди *
  • Red Hat Red Hat Openshift Data Foundation 4.22: 1782932114 преди *
  • Red Hat Red Hat OpenShift Dev Spaces 3.29: 1782991491 преди *
  • Red Hat Red Hat OpenShift distributed tracing 3.10.2: 1784775772 преди *
  • Red Hat Red Hat OpenShift GitOps 1.19: 1782292352 преди *
  • Red Hat Red Hat OpenShift GitOps 1.20: 1782383826 преди *
  • Red Hat Red Hat OpenShift Service Mesh 2.6: 1782287580 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.0: 1782201833 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.1: 1782201537 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.2: 1782201812 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.3: 1782201466 преди *
  • Red Hat Red Hat OpenShift Workload Availability 0.12: 1785202723 преди *
  • Red Hat Red Hat OpenShift Workload Availability 0.13: 1785203036 преди *
  • Red Hat Red Hat OpenShift Workload Availability 0.3: 1785203474 преди *
  • Red Hat Red Hat OpenShift Workload Availability 0.7: 1785203508 преди *
  • Red Hat Red Hat OpenShift Workload Availability 0.8: 1785203079 преди *
  • Red Hat Red Hat OpenShift Workload Availability 5.7: 1785202847 преди *
  • Red Hat Red Hat Quay 3.10: 1783750447 преди *
  • Red Hat Red Hat Quay 3.12: 1783751865 преди *; 1784353904 преди *
  • Red Hat Red Hat Quay 3.15: 1784351966 преди *
  • Red Hat Red Hat Quay 3.16: 1783955846 преди *
  • Red Hat Red Hat Quay 3.17: 1786181981 преди *
  • Red Hat Red Hat Quay 3.9: 1784125838 преди *
  • Red Hat Red Hat Satellite 6.18: 1785923308 преди *
  • Red Hat Red Hat Satellite 6.19: 1785929994 преди *
  • Red Hat Red Hat Trusted Artifact Signer 1.4: 4-1.4.2 преди *; 4-1.4.3 преди *
  • Red Hat Red Hat Web Terminal 1.11: 1784296203 преди *
  • Red Hat Red Hat Web Terminal 1.12: 1784247610 преди *
  • Red Hat Red Hat Web Terminal 1.13: 1784296127 преди *
  • Red Hat Red Hat Web Terminal 1.14: 1784296114 преди *
  • Red Hat Red Hat Web Terminal 1.15: 1784296033 преди *
  • Red Hat Red Hat Web Terminal 1.16: 1784295767 преди *
  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2
  • Red Hat Compliance Operator
  • Red Hat Confidential Compute Attestation
  • Red Hat Cryostat 4
  • Red Hat Deployment Validation Operator
  • Red Hat ExternalDNS Operator
  • Red Hat External Secrets Operator for Red Hat OpenShift
  • Red Hat Fence Agents Remediation Operator
  • Red Hat File Integrity Operator
  • Red Hat Gatekeeper 3
  • Red Hat Logical Volume Manager Storage
  • Red Hat Machine Deletion Remediation Operator
  • Red Hat Multiarch Tuning Operator
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat Network Observability Operator
  • Red Hat Node HealthCheck Operator
  • Red Hat OpenShift API for Data Protection
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat OpenShift Lightspeed
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Serverless
  • Red Hat Power monitoring for Red Hat OpenShift
  • Red Hat Red Hat 3scale API Management Platform 2
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ceph Storage 5
  • Red Hat Red Hat Ceph Storage 6
  • Red Hat Red Hat Ceph Storage 8
  • Red Hat Red Hat Ceph Storage 9
  • Red Hat Red Hat Certification Program for Red Hat Enterprise Linux 9
  • Red Hat Red Hat Connectivity Link 1
  • Red Hat Red Hat Developer Hub
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Cluster Manager CLI
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift distributed tracing 3
  • Red Hat Red Hat OpenShift for Windows Containers
  • Red Hat Red Hat OpenShift on AWS
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Service Interconnect 1
  • Red Hat Red Hat Service Interconnect 2
  • Red Hat Security Profiles Operator
  • Red Hat Zero Trust Workload Identity Manager
  • Red Hat Zero Trust Workload Identity Manager - Tech Preview

Вид слабост

История

  • 22 май 2026 Публикувано

Други уязвимости в Go standard library net/http

Първоизточници