2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46644

CVE-2026-46644: symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

Description

symfony/polyfill-intl-idn provides a userland implementation of idn_to_utf8() and idn_to_ascii() for runtimes that lack the intl extension. Its Idn::process() method decodes labels prefixed with xn-- using Punycode but never enforces the validity criterion added in UTS #46 revision 33 Section 4 step 4.1.2: after a successful Punycode decode, the result must contain at least one non-ASCII code point.

As a consequence, xn-- labels whose Punycode payload is empty (xn--) or decodes to a string made of only ASCII code points (e.g. xn--kc1zs4-) are accepted by the polyfill while PHP's native ext-intl rejects them with IDNA_ERROR_INVALID_ACE_LABEL. Originally unequal domain names are therefore regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing and server-side request forgery (similar to CVE-2024-12224).

Example with IDNA_USE_STD3_RULES | IDNA_CHECK_BIDI | IDNA_CHECK_CONTEXTJ | IDNA_NONTRANSITIONAL_TO_ASCII:

| Input | Polyfill output | Native ext-intl output | | --- | --- | --- | | poc.xn--kc1zs4-.com | poc.kc1zs4.com | false (errors=1024) | | poc.kc1zs4.xn-- | poc.kc1zs4. | false (errors=1024) |

Applications using the polyfill to canonicalise or compare hostnames inherit the inconsistency.

Resolution

Idn::process() now records IDNA_ERROR_INVALID_ACE_LABEL when a Punycode payload decodes to an empty string or to a string containing only ASCII code points, matching the native ext-intl behaviour and UTS #46 revision 33.

The patch for this issue is available here for branch 1.x.

Miggo Vulnerability Database

→

CVE-2026-46644

CVE-2026-46644:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
symfony/polyfill	composer	>= 1.17.1, < 1.38.1	1.38.1
symfony/polyfill-intl-idn	composer	>= 1.17.1, < 1.38.1	1.38.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the Idn::process method within src/Intl/Idn/Idn.php. This method is responsible for processing Internationalized Domain Names (IDNs). The flaw is that it does not correctly implement the validation required by UTS #46. Specifically, when a domain label prefixed with xn-- (a Punycode label) is decoded, the result must contain at least one non-ASCII character. The vulnerable version of the code does not perform this check, and as a result, it incorrectly processes labels that decode to ASCII-only strings. This can lead to security issues such as blacklist bypassing and server-side request forgery (SSRF), as different representations of the same domain are treated as equivalent.

The public functions Idn::idn_to_ascii and Idn::idn_to_utf8 are the primary entry points for this vulnerable logic. Any application using these functions from the symfony/polyfill-intl-idn package to process domain names is affected. The patch addresses the vulnerability by adding a check within the Idn::process method to ensure that any successfully decoded Punycode label contains at least one non-ASCII character, and if not, it flags an error, aligning the polyfill's behavior with the native intl extension.

Vulnerable functions

Idn::process

src/Intl/Idn/Idn.php

The `process` function is vulnerable because it decodes Punycode labels (labels starting with `xn--`) but fails to validate that the decoded output contains at least one non-ASCII character. The vulnerability is that it accepts labels that decode to ASCII-only strings, which should be rejected. This behavior is corrected in the patch by adding a check for non-ASCII characters.

Idn::idn_to_ascii

src/Intl/Idn/Idn.php

This function is a public entry point that uses the vulnerable `process` method. When a domain containing a Punycode label that decodes to an ASCII-only string is passed to `idn_to_ascii`, the vulnerability is triggered, leading to incorrect domain canonicalization.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

2.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-46644: symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

Description

Resolution

CVE-2026-46644:

2.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Technical Details

Basic Information

Basic Information

2.7

2.7

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-46644: symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

Description

Resolution

Credits

2.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-46644: symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

Description

Resolution

CVE-2026-46644:

2.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

2.7

2.7

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-46644: symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

Description

Resolution

Credits

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI