CLSA-2026-1784533387 golang: Fix of CVE-2026-39821

CVE-2026-39821: reject all-ASCII xn-- labels in the vendored golang.org/x/net/idna to prevent Punycode label spoofing...

CLSA-2026-1784074875 grafana: Fix of CVE-2026-39821

CVE-2026-39821: reject all-ASCII xn-- labels in vendored golang.org/x/net/idna backport of upstream commit f05f21b...

CVE-2026-46644

Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process does not enforce the UTS 46...

CLSA-2026-1784027626 grafana-pcp: Fix of CVE-2026-39821

CVE-2026-39821: reject all-ASCII xn-- labels in vendored golang.org/x/net/idna backport of upstream commit f05f21b...