Most recent entries from all

EUVD-2026-337876

fkie_cve-2026-46644

Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.38.1.

GHSA-2xf4-cg6j-vhgq — symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

Affected: Packagist: symfony/polyfill, Packagist: symfony/polyfill-intl-idn

### Description

`symfony/polyfill-intl-idn` provides a userland implementation of `idn_to_utf8()` and `idn_to_ascii()` for runtimes that lack the `intl` extension. Its `Idn::process()` method decodes labels prefixed with `xn--` using Punycode but never enforces the validity criterion added in UTS #46 revision 33 Section 4 step 4.1.2: after a successful Punycode decode, the result must contain at least one non-ASCII code point.

As a consequence, `xn--` labels whose Punycode payload is empty (`xn--`) or decodes to a string made of only ASCII code points (e.g. `xn--kc1zs4-`) are accepted by the polyfill while PHP's native `ext-intl` rejects them with `IDNA_ERROR_INVALID_ACE_LABEL`. Originally unequal domain names are therefore regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing and server-side request forgery (similar to CVE-2024-12224).

Example with `IDNA_USE_STD3_RULES | IDNA_CHECK_BIDI | IDNA_CHECK_CONTEXTJ | IDNA_NONTRANSITIONAL_TO_ASCII`:

| Input | Polyfill output | Native `ext-intl` output | | --- | --- | --- | | `poc.xn--kc1zs4-.com` | `poc.kc1zs4.com` | `false` (`errors=1024`) | | `poc.kc1zs4.xn--` | `poc.kc1zs4.` | `false` (`errors=1024`) |

Applications using the polyfill to canonicalise or compare hostnames inherit the inconsistency.

### Resolution

`Idn::process()` now records `IDNA_ERROR_INVALID_ACE_LABEL` when a Punycode payload decodes to an empty string or to a string containing only ASCII code points, matching the native `ext…

UBUNTU-CVE-2026-46644

Affected: Ubuntu:18.04:LTS: php-symfony-polyfill, Ubuntu:22.04:LTS: php-symfony-polyfill, Ubuntu:24.04:LTS: php-symfony-polyfill, Ubuntu:25.10: php-symfony-polyfill, Ubuntu:26.04:LTS: php-symfony-polyfill