CVE-2026-39821 is a vulnerability in golang.org/x/net/idna where the ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to ASCII-only hostnames, such as xn--example-.com being normalized to example.com instead of producing an error. This improper validation can allow an attacker to supply a Punycode hostname that passes an ASCII-only authorization check but is normalized to a restricted ASCII hostname, resulting in privilege escalation. Red Hat products including RHEL, OpenShift, and Advanced Cluster Security that ship the Go toolchain or bundle golang.org/x/net are exposed. The issue is addressed by upgrading to a fixed golang.org/x/net release with the corrected idna handling.

The vulnerability allows privilege escalation by bypassing hostname validation checks, potentially granting unauthorized access to restricted hostnames. The impact is rated high by Red Hat, with confidentiality and integrity impacts considered high, but no availability impact. The exposure is broad across multiple Red Hat products that include the affected Go packages.

Red Hat advises upgrading to the fixed golang.org/x/net release that includes the corrected idna processing. This is done via updated golang or dependent package rebuilds provided by Red Hat. Users should apply the security updates released by Red Hat for their affected products as detailed in the Red Hat Security Advisory RHSA-2026:26546. No alternative mitigations are specified.