CVE-2026-46644

Awaiting Analysis Awaiting Analysis - Queue

Symfony Polyfill Intl IDN Hostname Spoofing via Empty Punycode

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.38.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-46644

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	polyfill_intl_idn	to 1.38.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1289	The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attack-Flow Graph

Executive Summary

This vulnerability affects Symfony Polyfill's intl-idn component. It allows xn-- labels with empty Punycode payloads or ASCII-only decoded labels to bypass proper domain name validation. This can cause different domain names to be treated as identical, leading to issues like blacklist bypassing, inconsistent URL parsing, and server-side request forgery.

Detection Guidance

This vulnerability can be detected by checking the version of symfony/polyfill-intl-idn. If your system uses a version between 1.17.1 and 1.38.0, it is vulnerable. Run: composer show symfony/polyfill-intl-idn to check the installed version.

Impact Analysis

Applications using the affected polyfill versions may incorrectly process or compare hostnames. This could allow attackers to bypass security measures, access unauthorized resources, or manipulate URL-based operations in systems relying on hostname validation.

Compliance Impact

This vulnerability may impact compliance by enabling unauthorized data access or manipulation through domain spoofing. Organizations using affected versions could face violations of data protection requirements like GDPR or HIPAA due to insufficient hostname validation.

Mitigation Strategies

Update symfony/polyfill-intl-idn to version 1.38.1 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-46644. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70