Описание
Уязвимость пакета golang-x-net языка программирования Golang связана с неправильной проверкой небезопасной эквивалентности входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти существующие ограничения безопасности и выполнить произвольный код
Вендор
Red Hat, Inc.
Сообщество свободного программного обеспечения
Canonical Ltd.
ООО «Ред Софт»
The Go Project
Наименование ПО
Red Hat Enterprise Linux
Debian GNU/Linux
Ubuntu
Red Hat 3scale API Management Platform
РЕД ОС
Red Hat OpenShift Container Platform
Red Hat Satellite
Red Hat OpenStack Platform
OpenShift Developer Tools and Services
Red Hat Ceph Storage
Red Hat OpenShift on AWS
Node HealthCheck Operator
Network Observability Operator
Red Hat OpenShift Virtualization
OpenShift Serverless
OpenShift Pipelines
Red Hat OpenShift Lightspeed
Red Hat Ansible Automation Platform
Red Hat OpenShift Cluster Manager CLI
Red Hat Advanced Cluster Management for Kubernetes 2
Multiarch Tuning Operator
Assisted Installer for Red Hat OpenShift Container Platform
OpenShift API for Data Protection
Red Hat Quay
Red Hat Certification Program for Red Hat Enterprise Linux
Red Hat Connectivity Link
Fence Agents Remediation Operator
Red Hat Hardened Images
multicluster engine for Kubernetes
Red Hat OpenShift AI
Compliance Operator
Deployment Validation Operator
ExternalDNS Operator
File Integrity Operator
Machine Deletion Remediation Operator
Security Profiles Operator
Gatekeeper
Power monitoring for Red Hat OpenShift
Red Hat OpenShift for Windows Containers
Red Hat Trusted Artifact Signer
Red Hat OpenShift Dev Spaces
Red Hat Openshift Data Foundation
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security
Red Hat Edge Manager
Red Hat Enterprise Linux AI
Cluster Observability Operator
Red Hat OpenShift Builds
Red Hat OpenShift GitOps
Multicluster Global Hub
golang.org/x/net/html
Cert Manager support for Red Hat OpenShift release
Logging for Red Hat OpenShift
Logging subsystem for Red Hat OpenShift
Red Hat Advanced Cluster Security for Kubernetes
Red Hat Migration Toolkit for Containers
Red Hat Migration Toolkit for Applications
Red Hat multicluster global hub
Red Hat OpenShift Workload Availability
Red Hat OpenShift distributed tracing
Streams for Apache Kafka
Red Hat OpenShift Service Mesh
Red Hat Web Terminal
Версия ПО
7 (Red Hat Enterprise Linux)
9 (Debian GNU/Linux)
18.04 LTS (Ubuntu)
8 (Red Hat Enterprise Linux)
20.04 LTS (Ubuntu)
2 (Red Hat 3scale API Management Platform)
11 (Debian GNU/Linux)
12 (Debian GNU/Linux)
7.3 (РЕД ОС)
4 (Red Hat OpenShift Container Platform)
6 (Red Hat Satellite)
9 (Red Hat Enterprise Linux)
16.2 (Red Hat OpenStack Platform)
- (OpenShift Developer Tools and Services)
5 (Red Hat Ceph Storage)
- (Red Hat OpenShift on AWS)
- (Node HealthCheck Operator)
- (Network Observability Operator)
4 (Red Hat OpenShift Virtualization)
- (OpenShift Serverless)
17.1 (Red Hat OpenStack Platform)
- (OpenShift Pipelines)
6 (Red Hat Ceph Storage)
8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux)
7 Extended Lifecycle Support (Red Hat Enterprise Linux)
6.16 for RHEL 8 (Red Hat Satellite)
6.16 for RHEL 9 (Red Hat Satellite)
4.16 (Red Hat OpenShift Container Platform)
8 (Red Hat Ceph Storage)
- (Red Hat OpenShift Lightspeed)
2.5 for RHEL 8 (Red Hat Ansible Automation Platform)
2.5 for RHEL 9 (Red Hat Ansible Automation Platform)
- (Red Hat OpenShift Cluster Manager CLI)
- (Red Hat Advanced Cluster Management for Kubernetes 2)
10 (Red Hat Enterprise Linux)
8.8 Telecommunications Update Service (Red Hat Enterprise Linux)
8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux)
9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux)
4.18 (Red Hat OpenShift Container Platform)
4.19 (Red Hat OpenShift Container Platform)
- (Multiarch Tuning Operator)
13 (Debian GNU/Linux)
8.6 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux)
2 (Assisted Installer for Red Hat OpenShift Container Platform)
9.6 Extended Update Support (Red Hat Enterprise Linux)
8.0 (РЕД ОС)
9 (Red Hat Ceph Storage)
10.0 Extended Update Support (Red Hat Enterprise Linux)
6.17 for RHEL 9 (Red Hat Satellite)
1.3 (OpenShift API for Data Protection)
3.12 (Red Hat Quay)
3.9 (Red Hat Quay)
3.14 (Red Hat Quay)
3.15 (Red Hat Quay)
3.16 (Red Hat Quay)
6.18 (Red Hat Satellite)
9 (Red Hat Certification Program for Red Hat Enterprise Linux)
1 (Red Hat Connectivity Link)
2.6 for RHEL 9 (Red Hat Ansible Automation Platform)
6.18 for RHEL 9 (Red Hat Satellite)
2.6 (Red Hat Ansible Automation Platform)
- (Fence Agents Remediation Operator)
1 (Red Hat Hardened Images)
2.9 (multicluster engine for Kubernetes)
2.25 (Red Hat OpenShift AI)
- (Compliance Operator)
- (Deployment Validation Operator)
- (ExternalDNS Operator)
- (File Integrity Operator)
- (Machine Deletion Remediation Operator)
- (Security Profiles Operator)
3 (Gatekeeper)
- (Power monitoring for Red Hat OpenShift)
- (Red Hat OpenShift for Windows Containers)
4.20 (Red Hat OpenShift Container Platform)
9.4 Update Services for SAP Solutions (Red Hat Enterprise Linux)
1.4 (Red Hat Trusted Artifact Signer)
2.6 (multicluster engine for Kubernetes)
2.8 (multicluster engine for Kubernetes)
4.21 (Red Hat OpenShift Container Platform)
4.22 (Red Hat OpenShift Container Platform)
3.29 (Red Hat OpenShift Dev Spaces)
4.22 (Red Hat Openshift Data Foundation)
1.6 (OpenShift API for Data Protection)
2.13 (Red Hat Advanced Cluster Management for Kubernetes)
4.9 (Red Hat Advanced Cluster Security)
1.0 (Red Hat Edge Manager)
1.1 (Red Hat Edge Manager)
3.4 (Red Hat Enterprise Linux AI)
1.5.0 (Cluster Observability Operator)
3.10 (Red Hat Quay)
3.17 (Red Hat Quay)
1.8.1 (Red Hat OpenShift Builds)
1.19 (Red Hat OpenShift GitOps)
2.7 (Red Hat Ansible Automation Platform)
6.19 for RHEL 9 (Red Hat Satellite)
3.4 (Red Hat OpenShift AI)
4.18 (Red Hat Openshift Data Foundation)
1.6.5 (Multicluster Global Hub)
2.11 (Red Hat Advanced Cluster Management for Kubernetes)
6.19 (Red Hat Satellite)
до 0.55.0 (golang.org/x/net/html)
2.11 (multicluster engine for Kubernetes)
2.6 for RHEL 10 (Red Hat Ansible Automation Platform)
1.19 (Cert Manager support for Red Hat OpenShift release)
6 (Logging for Red Hat OpenShift)
6.2 (Logging subsystem for Red Hat OpenShift)
6.4 (Logging subsystem for Red Hat OpenShift)
6.5 (Logging subsystem for Red Hat OpenShift)
1.4.9 (Multicluster Global Hub)
1.5 (OpenShift API for Data Protection)
4.10 (Red Hat Advanced Cluster Security for Kubernetes)
4.11 (Red Hat Advanced Cluster Security for Kubernetes)
1.8 (Red Hat Migration Toolkit for Containers)
8.1 (Red Hat Migration Toolkit for Applications)
8.2 (Red Hat Migration Toolkit for Applications)
1.5.3 (Red Hat multicluster global hub)
1.20 (Red Hat OpenShift GitOps)
0.12 (Red Hat OpenShift Workload Availability)
0.13 (Red Hat OpenShift Workload Availability)
0.3 (Red Hat OpenShift Workload Availability)
0.7 (Red Hat OpenShift Workload Availability)
0.8 (Red Hat OpenShift Workload Availability)
5.7 (Red Hat OpenShift Workload Availability)
2.7 for RHEL 10 (Red Hat Ansible Automation Platform)
2.7 for RHEL 9 (Red Hat Ansible Automation Platform)
3.11.1 (Red Hat OpenShift distributed tracing)
3.2.1 (Streams for Apache Kafka)
1.7.3 (Multicluster Global Hub)
1.7.3 (Red Hat OpenShift Builds)
3.10.2 (Red Hat OpenShift distributed tracing)
2.6 (Red Hat OpenShift Service Mesh)
3.0 (Red Hat OpenShift Service Mesh)
3.1 (Red Hat OpenShift Service Mesh)
3.2 (Red Hat OpenShift Service Mesh)
3.3 (Red Hat OpenShift Service Mesh)
1.11 (Red Hat Web Terminal)
1.12 (Red Hat Web Terminal)
1.13 (Red Hat Web Terminal)
1.14 (Red Hat Web Terminal)
1.15 (Red Hat Web Terminal)
1.16 (Red Hat Web Terminal)
Тип ПО
Операционная система
Прикладное ПО информационных систем
ПО программно-аппаратного средства
ПО виртуализации/ПО виртуального программно-аппаратного средства
Сетевое средство
Сетевое программное средство
Операционные системы и аппаратные платформы
Red Hat, Inc. Red Hat Enterprise Linux 7
Сообщество свободного программного обеспечения Debian GNU/Linux 9
Canonical Ltd. Ubuntu 18.04 LTS
Red Hat, Inc. Red Hat Enterprise Linux 8
Canonical Ltd. Ubuntu 20.04 LTS
Сообщество свободного программного обеспечения Debian GNU/Linux 11
Сообщество свободного программного обеспечения Debian GNU/Linux 12
ООО «Ред Софт» РЕД ОС 7.3
Red Hat, Inc. Red Hat Enterprise Linux 9
Red Hat, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat, Inc. Red Hat Enterprise Linux 10
Red Hat, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Сообщество свободного программного обеспечения Debian GNU/Linux 13
Red Hat, Inc. Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Red Hat, Inc. Red Hat Enterprise Linux 9.6 Extended Update Support
ООО «Ред Софт» РЕД ОС 8.0
Red Hat, Inc. Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat, Inc. Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Red Hat, Inc. Red Hat Enterprise Linux AI 3.4
Уровень опасности уязвимости
Средний уровень опасности (базовая оценка CVSS 2.0 составляет 6,6)
Высокий уровень опасности (базовая оценка CVSS 3.1 составляет 8,2)
Возможные меры по устранению уязвимости
В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Ред ОС:
http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
http://repo.red-soft.ru/redos/8.0/x86_64/updates/
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2026-39821
https://deb.freexian.com/extended-lts/tracker/CVE-2026-39821
Для Ubuntu:
https://ubuntu.com/security/CVE-2026-39821
Для программных продуктов Red Hat, Inc.:
https://access.redhat.com/security/cve/CVE-2026-39821
Статус уязвимости
Подтверждена производителем
Наличие эксплойта
Данные уточняются
Информация об устранении
Уязвимость устранена
Ссылки на источники
Идентификаторы других систем описаний уязвимостей
- CVE
EPSS
Процентиль: 52%
0.00692
Низкий
8.2 High
CVSS3
6.6 Medium
CVSS2
Связанные уязвимости
CVSS3: 9.6
altlinux
4 месяца назад
ALT-PU-2026-10774: package `etcd` update to version 3.5.32-alt1
CVSS3: 9.6
altlinux
2 месяца назад
ALT-PU-2026-13559: package `golang` update to version 1.26.7-alt1
CVSS3: 9.6
altlinux
4 месяца назад
ALT-PU-2026-9801: package `mimir` update to version 3.1.1-alt1
CVSS3: 9.6
ubuntu
5 месяцев назад
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
CVSS3: 8.2
redhat
5 месяцев назад
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
EPSS
Процентиль: 52%
0.00692
Низкий
8.2 High
CVSS3
6.6 Medium
CVSS2