CVE-2026-39821 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-39821	HIGH	stdlib	v1.26.5	1.25.13, 1.26.6, 1.27.0-rc.3	2026-05-22T16:16:20.41Z	2026-08-14T10:18:19.278559625Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/provided:latest	public.ecr.aws/lambda/provided@sha256:e67a8a0c4c15952c4e1189d8940bfea65a7087f0bc0c93981572759de2e6e4e7
public.ecr.aws/lambda/provided:al2023	public.ecr.aws/lambda/provided@sha256:e67a8a0c4c15952c4e1189d8940bfea65a7087f0bc0c93981572759de2e6e4e7
public.ecr.aws/lambda/python:latest	public.ecr.aws/lambda/python@sha256:0e616b1c3e96317a7b27506e9db6aa1a7e2796356a853cfc2e503cc898b40432
public.ecr.aws/lambda/python:3.14	public.ecr.aws/lambda/python@sha256:0e616b1c3e96317a7b27506e9db6aa1a7e2796356a853cfc2e503cc898b40432
public.ecr.aws/lambda/python:3.13	public.ecr.aws/lambda/python@sha256:e9128b473a41e94296743f7185d2c4431b037f337a668fe05e2ed8fe98e72393
public.ecr.aws/lambda/python:3.12	public.ecr.aws/lambda/python@sha256:69da445c4d7a08522495cef038a84391d2cb94c76fa651f23f277aeeafde78b0
public.ecr.aws/lambda/python:3.11	public.ecr.aws/lambda/python@sha256:785524b31a0c7f8ad2eb21f3201c7295efab99a1008f08296517c10e742838fe
public.ecr.aws/lambda/python:3.10	public.ecr.aws/lambda/python@sha256:4dae68caacff8062b68f81cdb90c194eef3b16a19a69aae03331acf70b2c20ec
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:f9db8942b3aa899ab6f5af03fc5deb937068d706b8e3855d54670cfd36b06659
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:f9db8942b3aa899ab6f5af03fc5deb937068d706b8e3855d54670cfd36b06659
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:4d8e0914d9deda36ed68ff552e028b70b2df1c869e1bc88b5a4363782a8423ba
public.ecr.aws/lambda/java:latest	public.ecr.aws/lambda/java@sha256:039c8f7225340b49dc2419d4df7fee43f2bab809c5bf6d71ade4e24408ac42ba
public.ecr.aws/lambda/java:25	public.ecr.aws/lambda/java@sha256:039c8f7225340b49dc2419d4df7fee43f2bab809c5bf6d71ade4e24408ac42ba
public.ecr.aws/lambda/java:21	public.ecr.aws/lambda/java@sha256:958945e0e26b83aae5f43a0a038b97c91bdbfc4759bc856d615bc7ce8dfd3a0c
public.ecr.aws/lambda/java:17	public.ecr.aws/lambda/java@sha256:c3c6b5da71e19a1e878f4f8256d105ef16c03206d449e8163d372443cf658615
public.ecr.aws/lambda/java:11	public.ecr.aws/lambda/java@sha256:8a12799f52e895e0ef1362f235d82a861215efd804e3cf94d9e57354860054cb
public.ecr.aws/lambda/java:8.al2	public.ecr.aws/lambda/java@sha256:72355ec53e95f32b387d5f0e880fbc18078cc43ab792ef3648283b8b243345c6
public.ecr.aws/lambda/dotnet:latest	public.ecr.aws/lambda/dotnet@sha256:cb80e593da35a4eeaed69674eb9efea4a737be9132fd07b189f00f7d6bb2a82f
public.ecr.aws/lambda/dotnet:10	public.ecr.aws/lambda/dotnet@sha256:cb80e593da35a4eeaed69674eb9efea4a737be9132fd07b189f00f7d6bb2a82f
public.ecr.aws/lambda/dotnet:9	public.ecr.aws/lambda/dotnet@sha256:6f5308502265cbc097ef6c9f37266408abdf0575c6e69a1ed551f2f2003e6fef
public.ecr.aws/lambda/dotnet:8	public.ecr.aws/lambda/dotnet@sha256:16a77c168303250e6293bed16997847054f0eea1f880e9734d339e3802990671
public.ecr.aws/lambda/ruby:latest	public.ecr.aws/lambda/ruby@sha256:c11d1db3ce2267e676043eac370e153c4e1a7bd8f6a3ce42db1fce0307974f62
public.ecr.aws/lambda/ruby:4.0	public.ecr.aws/lambda/ruby@sha256:c11d1db3ce2267e676043eac370e153c4e1a7bd8f6a3ce42db1fce0307974f62
public.ecr.aws/lambda/ruby:3.4	public.ecr.aws/lambda/ruby@sha256:2ae95dfda2e9b4656b6eb3f0f8ca42fbb4d19c606ff8564e6fd90fb332082d3d
public.ecr.aws/lambda/ruby:3.3	public.ecr.aws/lambda/ruby@sha256:7739ee3227ddc2b2feae77ee67f437dadbce298c843bdb4c66719191b9034ac6

---

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

---

Remediation Steps

• Update the affected package stdlib from version v1.26.5 to 1.25.13, 1.26.6, 1.27.0-rc.3.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.