Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
Gatekeeper‑FIPS and Loki accept malformed domain names
published 16 days ago
Summary
The ToASCII and ToUnicode routines in Gatekeeper‑FIPS and Loki incorrectly treat specially‑crafted Punycode strings as valid, even though they decode to ordinary ASCII names. This can let attackers bypass checks that rely on proper domain‑name validation. Apply the latest software updates from the vendors to fix the problem.
What to do
- Update cleanstart gatekeeper-fips to version 3.22.0-r0.
- Update cleanstart loki to version 3.6.15-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | gatekeeper-fips |
< 3.22.0-r0 Fix: upgrade to 3.22.0-r0
|
| CleanStart | cleanstart | loki |
< 3.6.15-r0 Fix: upgrade to 3.6.15-r0
|
Original advisory text
ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published20 Oct 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLEANSTART-2026-TJ78726 · OSV
Track software like this
Free during beta