{"action":"Upgrade symfony/polyfill-intl-idn to 1.38.1 or later.","affected":[{"fixed":"1.38.1","introduced":"1.17.1"}],"component":"symfony/polyfill-intl-idn","cve_ids":["CVE-2026-46644"],"ecosystem":"Packagist","epss":0.00538,"exploited":false,"fixed_versions":["1.38.1"],"ghsa_id":"GHSA-2xf4-cg6j-vhgq","id":"tcs_01M5KESCP475Y1CSQZ774A1HHP","modified_at":"2026-09-10T03:51:04.192819875Z","published_at":"2026-05-28T19:52:36Z","references":["https://osv.dev/vulnerability/GHSA-2xf4-cg6j-vhgq","https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq","https://github.com/symfony/polyfill/commit/1be936e2491ccebe152bd736dfc91eb1422c8bec","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill-intl-idn/CVE-2026-46644.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill/CVE-2026-46644.yaml","https://github.com/symfony/polyfill","https://symfony.com/cve-2026-46644"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-2xf4-cg6j-vhgq#Packagist/symfony/polyfill-intl-idn","url":"https://osv.dev/vulnerability/GHSA-2xf4-cg6j-vhgq"}],"summary":"symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form"}