PT-2026-43392 · Symfony · Polyfill-Intl-Idn

CVE-2026-46644 · Published 2026-05-26 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions symfony/polyfill-intl-idn versions prior to 1.x

Description The Idn::process() function fails to enforce the validity criterion defined in UTS #46 revision 33 Section 4 step 4.1.2. Specifically, it does not verify that a label prefixed with xn-- contains at least one non-ASCII code point after Punycode decoding. This results in the acceptance of labels with empty Punycode payloads or those that decode only to ASCII characters, which are normally rejected by the native PHP ext-intl extension with an IDNA ERROR INVALID ACE LABEL error. This inconsistency in hostname canonicalization and comparison can lead to server-side request forgery, inconsistent URL parsing, and the bypassing of blacklists.

Recommendations Update to the patched version of the 1.x branch. As a temporary workaround, restrict the use of the Idn::process() function for validating or comparing hostnames until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-1289

Related Identifiers

CVE-2026-46644

GHSA-2XF4-CG6J-VHGQ

Affected Products

Polyfill-Intl-Idn

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46644.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill-intl-idn/CVE-2026-46644.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill/CVE-2026-46644.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46644 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-46644 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-46644 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46644 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46644 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-46644 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2xf4-cg6j-vhgq · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-46644 · Security Note
• https://github.com/symfony/polyfill/releases/tag/v1.38.1 · Note
• https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq · Note
• https://github.com/symfony/polyfill/commit/1be936e2491ccebe152bd736dfc91eb1422c8bec · Note
• https://github.com/symfony/polyfill · Note