CVE-2026-46644
2 advisories.
Packagist/symfony/polyfill CVE-2026-46644: low, EPSS 0.54%
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
Action: Upgrade symfony/polyfill to 1.38.1 or later.
composer require symfony/polyfill:1.38.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.17.1 | 1.38.1 | - |
Fixed versions
| 1.38.1 |
Sources
- osv: GHSA-2xf4-cg6j-vhgq
- https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq
- https://github.com/symfony/polyfill/commit/1be936e2491ccebe152bd736dfc91eb1422c8bec
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill-intl-idn/CVE-2026-46644.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill/CVE-2026-46644.yaml
- https://github.com/symfony/polyfill
- https://symfony.com/cve-2026-46644
CVE-2026-46644 · published · modified · JSON
Packagist/symfony/polyfill-intl-idn CVE-2026-46644: low, EPSS 0.54%
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
Action: Upgrade symfony/polyfill-intl-idn to 1.38.1 or later.
composer require symfony/polyfill-intl-idn:1.38.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.17.1 | 1.38.1 | - |
Fixed versions
| 1.38.1 |
Sources
- osv: GHSA-2xf4-cg6j-vhgq#Packagist/symfony/polyfill-intl-idn
- https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq
- https://github.com/symfony/polyfill/commit/1be936e2491ccebe152bd736dfc91eb1422c8bec
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill-intl-idn/CVE-2026-46644.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill/CVE-2026-46644.yaml
- https://github.com/symfony/polyfill
- https://symfony.com/cve-2026-46644
CVE-2026-46644 · published · modified · JSON