Ubuntu patches Go Punycode hostname access-control flaw

Ubuntu fixed a Go x/net/idna Punycode flaw that could bypass hostname controls, covering Go 1.23 and Google guest agents.

Ubuntu issued two related notices about a flaw in the Go x/net/idna package that incorrectly accepted Punycode-encoded labels decoding to ASCII-only labels during internationalized domain name processing. USN-8914-1, dated 2026-10-12, patches that library as vendored in Google Guest Agent and Google OS Config Agent and says a remote attacker could bypass hostname-based access controls and escalate privileges. USN-8883-2, dated 2026-10-15, extends an earlier Go fix—USN-8883-1, which covered Go 1.18, 1.21, and 1.24—to Go 1.23 and describes the same possible bypass and privilege escalation. The later notice does not report active exploitation and is less definite about exploitability, while the guest-agent notice specifically calls the attacker remote. Neither notice cites a CVE identifier.

• USN-8914-1 (2026-10-12) updates Google Guest Agent and Google OS Config Agent.
• The affected code is the vendored Go x/net/idna package, which accepted Punycode-encoded labels that decode to ASCII-only labels when processing internationalized domain names.
• Ubuntu says the flaw could bypass hostname-based access controls and escalate privileges.
• USN-8883-2 (2026-10-15) backports the Go fix to version 1.23.
• USN-8883-1 already covered Go 1.18, 1.21, and 1.24.
• USN-8883-2 does not report active exploitation.
• Neither notice states a CVE identifier.