{"action":"Upgrade symfony/polyfill to 1.38.1 or later.","affected":[{"fixed":"1.38.1","introduced":"1.17.1"}],"component":"symfony/polyfill","cve_ids":["CVE-2026-46644"],"ecosystem":"Packagist","epss":0.00538,"exploited":false,"fixed_versions":["1.38.1"],"ghsa_id":"GHSA-2xf4-cg6j-vhgq","id":"tcs_01M5KESCKB8115VPS6BPTW97ZC","modified_at":"2026-09-10T03:51:04.192819875Z","published_at":"2026-05-28T19:52:36Z","references":["https://osv.dev/vulnerability/GHSA-2xf4-cg6j-vhgq","https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq","https://github.com/symfony/polyfill/commit/1be936e2491ccebe152bd736dfc91eb1422c8bec","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill-intl-idn/CVE-2026-46644.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill/CVE-2026-46644.yaml","https://github.com/symfony/polyfill","https://symfony.com/cve-2026-46644"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-2xf4-cg6j-vhgq","url":"https://osv.dev/vulnerability/GHSA-2xf4-cg6j-vhgq"}],"summary":"symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form"}