Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.38.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
📢 CVE-2026-46644: insecure equivalence in symfony/polyfill-intl-idn for ASCII-only xn-- labels https://symfony.com/blog/cve-2026-46644-insecure-equivalence-in-symfony-polyfill-intl-idn-for-ascii-only-xn-labels
Post summary
The symfony blog post announces the disclosure of CVE-2026-46644, detailing an insecure equivalence flaw in the polyfill‐intl‐idn package for ASCII‑only xn‑ labels.
🟠 Symfony polyfill-intl-idn, IDN Punycode Validation Bypass, #CVE-2026-46644 (Medium) -DC-May2026-23 https://dailycve.com/symfony-polyfill-intl-idn-idn-punycode-validation-bypass-cve-2026-46644-medium-dc-may2026-23/
Post summary
A medium‑severity IDN Punycode validation bypass vulnerability (CVE‑2026‑46644) was disclosed for Symfony’s polyfill‑intl‑idn component, referenced via a DailyCVE link.