CVE-2026-39821 describes a vulnerability in the ToASCII and ToUnicode functions where Punycode-encoded labels that decode to ASCII-only labels are incorrectly accepted without error. This can lead to privilege escalation in applications using the idna package by bypassing hostname-based access controls. For example, a program might reject the ASCII hostname "example.com" but allow the Punycode variant "xn--example-.com", which converts back to "example.com" in Unicode, thus granting unintended access. Red Hat has acknowledged this issue and released security advisories with fixes for affected products including Red Hat Enterprise Linux and Ansible Automation Platform.

The vulnerability allows attackers to bypass hostname-based privilege checks by exploiting the incorrect acceptance of certain Punycode-encoded labels. This can lead to privilege escalation, allowing unauthorized access in programs relying on the idna package for hostname validation. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and high confidentiality and integrity impacts, with no availability impact.

Red Hat has released official security advisories (RHSA-2026:42142 and RHSA-2026:42132) providing updates that fix this vulnerability in affected products including Red Hat Enterprise Linux and Ansible Automation Platform versions 2.6 and 2.7. Users should apply these updates as instructed in the vendor advisories. Ensure all previously released errata relevant to your system are applied before updating. Patch status is confirmed as fixed in these advisories.