Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
Minio, Rclone, Etcd accept malformed Punycode domains
published 14 days ago
Summary
The Minio, Rclone and Etcd software can mistakenly treat specially encoded domain names (Punycode) that actually contain only regular letters and numbers as valid. This could allow unexpected domain handling or bypass of name checks. Update to the latest versions of each package or apply the vendors' patches to correct the validation.
What to do
- Update cleanstart minio to version 0.20250907.161309-r8.
- Update cleanstart rclone to version 1.74.3-r4.
- Update cleanstart etcd to version 3.4.45-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | minio |
< 0.20250907.161309-r8 Fix: upgrade to 0.20250907.161309-r8
|
| CleanStart | cleanstart | rclone |
< 1.74.3-r4 Fix: upgrade to 1.74.3-r4
|
| CleanStart | cleanstart | etcd |
< 3.4.45-r1 Fix: upgrade to 3.4.45-r1
|
Original advisory text
ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published22 Oct 2026
Updated22 Oct 2026
First seen22 Oct 2026
Sources
CLEANSTART-2026-PQ31428 · OSV
Track software like this
Free during beta