CVE-2026-46644

unknown

Published 2026-05-26 · Modified —

CVSS v3

—

CVSS v2

—

VIR risk

—

Description

CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2026-46644

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-46644 NameCVE-2026-46644 Descriptioninsecure equivalence in symfony/polyfill-intl-idn for ASCII-only xn-- labels SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source…

CVE-2026-46644

Name	CVE-2026-46644
Description	insecure equivalence in symfony/polyfill-intl-idn for ASCII-only xn-- labels
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-symfony-polyfill (PTS)	bullseye	1.22.1-1	vulnerable
	bookworm	1.27.0-2	vulnerable
	forky	1.37.0-1	vulnerable
	sid	1.38.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php-symfony-polyfill	source	(unstable)	1.38.1-1

Notes

[bookworm] - php-symfony-polyfill <no-dsa> (Minor issue)
https://symfony.com/blog/cve-2026-46644-insecure-equivalence-in-symfony-polyfill-intl-idn-for-ascii-only-xn-labels
https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[bookworm] - php-symfony-polyfill <no-dsa> (Minor issue)https://symfony.com/blog/cve-2026-46644-insecure-equivalence-in-symfony-polyfill-intl-idn-for-ascii-only-xn-labelshttps://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq

OS impact

OS	Version	Status	Fixed in
debian	bookworm	affected
debian	bullseye	affected
debian	forky	affected
debian	sid	fixed	`1.38.1-1`

Package impact

Ecosystem	Package	Vulnerable	Fixed
Packagist	symfony/polyfill-intl-idn	`>=1.17.1,<1.38.1`
Packagist	symfony/polyfill	`>=1.17.1,<1.38.1`

References

Verify integrity in audit chain (admin only). AS-IS.