CVE-2026-46644: Symfony Polyfill improper validation of Punycode labels in Intl-Idn

CVE-2026-46644 · Severity: medium · CVSS 4 · Published 2026-07-14

A vulnerability exists in a Symfony component used to handle internationalized domain names (IDNs) in PHP applications. The software incorrectly treats certain malformed web addresses as valid, which can allow attackers to bypass security filters or trick servers into making unauthorized requests (SSRF). This could lead to unauthorized access to internal systems or the bypassing of domain-based blocklists.

Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-46644 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46644 being exploited in the wild.
How severe is CVE-2026-46644?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
symfony/polyfill (Packagist) >= 1.17.1, < 1.38.1, ECOSYSTEM:introduced=1.17.1,fixed=1.38.1; symfony/polyfill-intl-idn (Packagist) >= 1.17.1, < 1.38.1, ECOSYSTEM:introduced=1.17.1,fixed=1.38.1; Symfony Polyfill >= 1.17.1, < 1.38.1; Symfony Polyfill-Intl-Idn >= 1.17.1, < 1.38.1.
Is there a fix for CVE-2026-46644?
Yes. symfony/polyfill (Packagist): upgrade to 1.38.1 or later; symfony/polyfill-intl-idn (Packagist): upgrade to 1.38.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46644 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46644?
Check whether you run symfony/polyfill (Packagist), symfony/polyfill-intl-idn (Packagist), Symfony Polyfill or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/polyfill (Packagist): upgrade to 1.38.1 or later
    composer require symfony/polyfill:^1.38.1
  • symfony/polyfill-intl-idn (Packagist): upgrade to 1.38.1 or later
    composer require symfony/polyfill-intl-idn:^1.38.1

Technical details

The symfony/polyfill-intl-idn package fails to enforce the UTS #46 revision 33 requirement in its Idn::process() method. Specifically, it does not verify that decoded ACE (xn--) labels contain at least one non-ASCII code point. This allows labels with empty or ASCII-only Punycode payloads to be accepted rather than rejected with an IDNA_ERROR_INVALID_ACE_LABEL. An attacker can exploit this inconsistency to cause originally unequal domain names to be treated as equivalent. This can result in blacklist bypassing, inconsistent URL parsing, and Server-Side Request Forgery (SSRF) in applications that rely on the polyfill for hostname canonicalization or comparison. The issue is fixed in version 1.38.1.

Affected products

  • Symfony polyfill-intl-idn >= 1.17.1, < 1.38.1
  • Symfony polyfill >= 1.17.1, < 1.38.1

Identifiers

  • CVE-2026-46644
  • GHSA-2xf4-cg6j-vhgq

Timeline

  • 2026-05-26: patched: Version 1.38.1 released
  • 2026-05-26: advisory: GitHub Security Advisory GHSA-2xf4-cg6j-vhgq published
  • 2026-07-14: disclosed: CVE-2026-46644 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.