The golang.org/x/net/idna package's ToASCII and ToUnicode functions incorrectly handle Punycode-encoded labels that decode to ASCII-only labels. Specifically, ToUnicode("xn--example-.com") returns "example.com" instead of an error, which can cause programs relying on ASCII hostname checks to mistakenly permit access. This improper validation of equivalence in input can lead to privilege escalation in applications using this package for hostname processing.

This vulnerability can lead to privilege escalation in applications that use the idna package for hostname validation and perform access control based on ASCII hostnames. An attacker could exploit this by using specially crafted Punycode labels that bypass ASCII hostname checks but are later converted to allowed Unicode hostnames, thereby gaining unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, developers should carefully review hostname validation logic when using the golang.org/x/net/idna package and consider additional validation steps to ensure consistent handling of Punycode and Unicode hostnames.