Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

A flaw in Go's domain name processing allows attackers to bypass security checks by using a hidden encoding (Punycode) for domain names. An attacker could gain unauthorized access by using an encoded version of a domain that a security system thought it had blocked.

The idna package's ToASCII and ToUnicode functions fail to reject Punycode-encoded labels that decode to ASCII-only strings, enabling bypass of hostname-based access controls. An attacker can supply a Punycode domain (e.g., 'xn--example-.com') that decodes to a legitimate ASCII domain, allowing the application to pass validation checks that would normally deny the ASCII version, leading to privilege escalation.