Go could allow unintended access to network services.

Software Description:

- golang-1.23: Go programming language compiler

Details:

USN-8883-1 fixed a vulnerability in Go versions 1.18, 1.21, and 1.24. This

update provides the corresponding fix for Go version 1.23.

Original advisory details:

It was discovered that the Go x/net/idna package incorrectly handled

certain Punycode-encoded labels that decoded to ASCII-only labels. An

attacker could possibly use this issue to bypass hostname-based access

controls and escalate privileges.

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  golang-1.23                     1.23.1-1~22.04.3
  golang-1.23-go                  1.23.1-1~22.04.3
  golang-1.23-src                 1.23.1-1~22.04.3

In general, a standard system update will make all the necessary changes.

https://ubuntu.com/security/notices/USN-8883-2

https://ubuntu.com/security/notices/USN-8883-1

CVE-2026-39821