CVE-2026-46644
CVE-2026-46644 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1289.
Key facts
- Severity: Medium (CVSS 4.0 base score 6.9)
- EPSS exploit prediction: 1% (43rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-1289
- Published:
- Last modified:
Description
Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.38.1.
Frequently asked questions
- What is CVE-2026-46644?
- Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.38.1.
- How severe is CVE-2026-46644?
- CVE-2026-46644 has a CVSS 4.0 base score of 6.9, rated medium severity.
- Is CVE-2026-46644 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-46644?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-46644 published?
- CVE-2026-46644 was published on 2026-07-14 and last updated on 2026-07-15.
References
- https://github.com/symfony/polyfill/commit/1be936e2491ccebe152bd736dfc91eb1422c8bec
- https://github.com/symfony/polyfill/releases/tag/v1.38.1
- https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq
Other CWE-1289 vulnerabilities
- CVE-2026-39821 — Critical (CVSS 9.6): The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For…
- CVE-2026-50090 — Critical (CVSS 9.3): The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due…
- CVE-2026-97196 — Critical (CVSS 9.1): Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication…
- CVE-2026-102478 — High (CVSS 8.7): In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the…
- CVE-2026-86831 — High (CVSS 8.7): Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before…
- CVE-2026-100255 — High (CVSS 8.1): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password…