CVE-2026-46644

Name	CVE-2026-46644
Description	Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.38.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-symfony-polyfill (PTS)	bullseye	1.22.1-1	vulnerable
	bookworm	1.27.0-2	vulnerable
	forky	1.40.0-2	fixed
	sid	1.41.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php-symfony-polyfill	source	(unstable)	1.38.1-1

Notes

[bookworm] - php-symfony-polyfill <no-dsa> (Minor issue)
[bullseye] - php-symfony-polyfill <postponed> (Minor issue; can be fixed with next upload)
https://symfony.com/blog/cve-2026-46644-insecure-equivalence-in-symfony-polyfill-intl-idn-for-ascii-only-xn-labels
https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq