| Name | CVE-2026-46644 |
| Description | insecure equivalence in symfony/polyfill-intl-idn for ASCII-only xn-- labels |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| php-symfony-polyfill (PTS) | bullseye | 1.22.1-1 | vulnerable |
| bookworm | 1.27.0-2 | vulnerable |
| forky | 1.37.0-1 | vulnerable |
| sid | 1.38.1-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[bookworm] - php-symfony-polyfill <no-dsa> (Minor issue)
https://symfony.com/blog/cve-2026-46644-insecure-equivalence-in-symfony-polyfill-intl-idn-for-ascii-only-xn-labels
https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq