The advisory covers a high-severity vulnerability (CVE-2026-39821) in golang.org/x/net/idna's ToASCII and ToUnicode functions, which incorrectly accept certain Punycode-encoded labels that decode to ASCII-only hostnames. This can allow an attacker to bypass ASCII hostname validation checks and escalate privileges by normalizing a Punycode hostname to a restricted ASCII name. Red Hat products shipping the Go toolchain or bundling golang.org/x/net, including RHEL AI, are affected. The update provides new RHEL AI 3.4.1 container images containing fixes. The vendor advisory recommends upgrading to fixed golang.org/x/net releases via updated golang or dependent package rebuilds. No direct patch links are provided, but updated container images are available from Red Hat's container registry.

If exploited, this vulnerability could allow an attacker who can supply a Punycode hostname to bypass ASCII-only authorization checks, potentially granting unauthorized access to restricted hostnames. This leads to privilege escalation in affected applications that rely on these hostname validations. The impact is rated high by Red Hat. There are no known exploits in the wild at this time.

Red Hat recommends upgrading to the updated golang.org/x/net release that includes the corrected idna handling. This is achieved by deploying the updated Red Hat Enterprise Linux AI 3.4.1 container images available from the Red Hat container registry. Users should pull the latest container images using the 'podman pull' command as described in the advisory. No other specific mitigations are noted. Patch status is that updated container images containing the fix are available.