CVE-2026-39821 -- CVSS 9.6 Vulnerability Briefing
CVE-2026-39821 | CVSS 9.6 (Critical) | Exploit: No known exploit
What Is It
CVE-2026-39821 is a logic flaw in Internationalized Domain Name (IDN) processing functions, specifically ToASCII and ToUnicode, which incorrectly handle Punycode-encoded labels that resolve to ASCII-only output, enabling domain name spoofing attacks.
Technical Detail
The vulnerability exists in the ToASCII and ToUnicode functions, which fail to reject Punycode-encoded labels that decode to a plain ASCII result -- for example, the input "xn--example-.com" is incorrectly returned as "example.com" rather than being flagged as invalid. This behavior violates RFC 5891 processing rules, which prohibit Punycode encoding of labels that are already valid ASCII. An attacker can exploit this flaw to construct domain names that appear visually and functionally identical to legitimate domains, enabling phishing, certificate validation bypass, or security control evasion in any application or library that relies on these functions for domain name resolution or display.
Exploitation Status
No known exploit exists for this vulnerability at this time. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as none, meaning no public proof-of-concept or weaponized code has been observed. However, the spoofing primitive this flaw provides is conceptually straightforward and may be reproducible by a skilled attacker without significant effort once the flaw is understood.
Who Is Targeting This
No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this CVE as of the date of this briefing.
What To Do
Apply vendor-supplied patches as soon as they become available, prioritizing any libraries, resolvers, or applications that perform IDN processing in security-sensitive contexts such as certificate validation, email routing, browser rendering, or authentication flows. In the interim, organizations should audit their use of ToASCII and ToUnicode implementations and determine whether the underlying library version is affected. Detection can be approached by monitoring for Punycode-encoded domain labels in DNS queries or application logs where the decoded output is a plain ASCII string, which should not occur under correct RFC 5891 processing. Given the CVSS score of 9.6, this should be treated as a high-priority patch target even in the absence of confirmed exploitation.