# CVE-2026-46644: Symfony Polyfill improper validation of Punycode labels in Intl-Idn

Source: https://junglewise.ai/threats/cve-2026-46644-symfony-polyfill-improper-validation-of-punycode-labels-in-intl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-46644 · Severity: medium · CVSS 4 · Published 2026-07-14

A vulnerability exists in a Symfony component used to handle internationalized domain names (IDNs) in PHP applications. The software incorrectly treats certain malformed web addresses as valid, which can allow attackers to bypass security filters or trick servers into making unauthorized requests (SSRF). This could lead to unauthorized access to internal systems or the bypassing of domain-based blocklists.

Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Symfony](https://junglewise.ai/threats/vendors/symfony).

## Quick answers

**Is CVE-2026-46644 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46644 being exploited in the wild.

**How severe is CVE-2026-46644?** Medium severity, with a CVSS score of 4, published 14 July 2026.

**Which products and versions are affected?** symfony/polyfill (Packagist) >= 1.17.1, < 1.38.1, ECOSYSTEM:introduced=1.17.1,fixed=1.38.1; symfony/polyfill-intl-idn (Packagist) >= 1.17.1, < 1.38.1, ECOSYSTEM:introduced=1.17.1,fixed=1.38.1; Symfony Polyfill >= 1.17.1, < 1.38.1; Symfony Polyfill-Intl-Idn >= 1.17.1, < 1.38.1.

**Is there a fix for CVE-2026-46644?** Yes. symfony/polyfill (Packagist): upgrade to 1.38.1 or later; symfony/polyfill-intl-idn (Packagist): upgrade to 1.38.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46644 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46644?** Check whether you run symfony/polyfill (Packagist), symfony/polyfill-intl-idn (Packagist), Symfony Polyfill or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- symfony/polyfill (Packagist): upgrade to 1.38.1 or later

  ```sh
  composer require symfony/polyfill:^1.38.1
  ```

- symfony/polyfill-intl-idn (Packagist): upgrade to 1.38.1 or later

  ```sh
  composer require symfony/polyfill-intl-idn:^1.38.1
  ```


## Technical details

The symfony/polyfill-intl-idn package fails to enforce the UTS #46 revision 33 requirement in its Idn::process() method. Specifically, it does not verify that decoded ACE (xn--) labels contain at least one non-ASCII code point. This allows labels with empty or ASCII-only Punycode payloads to be accepted rather than rejected with an IDNA_ERROR_INVALID_ACE_LABEL. An attacker can exploit this inconsistency to cause originally unequal domain names to be treated as equivalent. This can result in blacklist bypassing, inconsistent URL parsing, and Server-Side Request Forgery (SSRF) in applications that rely on the polyfill for hostname canonicalization or comparison. The issue is fixed in version 1.38.1.

## Affected products

- Symfony polyfill-intl-idn >= 1.17.1, < 1.38.1
- Symfony polyfill >= 1.17.1, < 1.38.1

## Identifiers

- CVE-2026-46644
- GHSA-2xf4-cg6j-vhgq

## Timeline

- 2026-05-26: patched: Version 1.38.1 released
- 2026-05-26: advisory: GitHub Security Advisory GHSA-2xf4-cg6j-vhgq published
- 2026-07-14: disclosed: CVE-2026-46644 published to NVD

## References

- [https://github.com/symfony/polyfill/commit/1be936e2491ccebe152bd736dfc91eb1422c8bec](https://github.com/symfony/polyfill/commit/1be936e2491ccebe152bd736dfc91eb1422c8bec)
- [https://github.com/symfony/polyfill/releases/tag/v1.38.1](https://github.com/symfony/polyfill/releases/tag/v1.38.1)
- [https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq](https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq)

## Related threats

- [Symfony Denial of Service Via Long Password Hashing](https://junglewise.ai/threats/cve-2013-5958-symfony-denial-of-service-via-long-password-hashing)