ToASCII and ToUnicode functions in golang.org/x/net’s idna package incorrectly accept Punycode‑encoded labels that decode to an ASCII‑only domain. Instead of returning an error, the functions return the ASCII name, allowing an attacker to supply an encoded hostname that passes initial ASCII validation but resolves to the same Unicode name after conversion. This flaw permits a program that performs privilege checks on the ASCII form but later uses the Unicode form to bypass authorization controls, resulting in privilege escalation.

The vulnerable component is the idna package within the golang.org/x/net Go module. No specific vulnerable version range is enumerated in the advisory; any release containing the bug before the fix is potentially affected. Systems that compile Go binaries or import older versions of golang.org/x/net should verify whether the patch has been applied.

Based on the description, it is inferred that the risk materializes when an application uses idna for hostname validation in authentication or access control. An attacker can provide a Punycode hostname that looks legitimate in ASCII checks yet matches the same Unicode name later, enabling privilege escalation. The CVSS score of 9.6 indicates critical severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, but the high severity and potential for privilege escalation keep the threat significant.