CVE-2026-46644
CVE-2026-46644 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1289.
Key facts
- Severity: Medium (CVSS 4.0 base score 6.9)
- EPSS exploit prediction: 0% (33rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-1289
- Published:
- Last modified:
Description
Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.38.1.
Frequently asked questions
- What is CVE-2026-46644?
- Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.38.1.
- How severe is CVE-2026-46644?
- CVE-2026-46644 has a CVSS 4.0 base score of 6.9, rated medium severity.
- Is CVE-2026-46644 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-46644?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-46644 published?
- CVE-2026-46644 was published on 2026-07-14 and last updated on 2026-07-15.
References
- https://github.com/symfony/polyfill/commit/1be936e2491ccebe152bd736dfc91eb1422c8bec
- https://github.com/symfony/polyfill/releases/tag/v1.38.1
- https://github.com/symfony/polyfill/security/advisories/GHSA-2xf4-cg6j-vhgq
Other CWE-1289 vulnerabilities
- CVE-2026-39821 — Critical (CVSS 9.6): The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For…
- CVE-2026-50090 — Critical (CVSS 9.3): The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due…
- CVE-2024-42219 — High (CVSS 7.8): 1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process…
- CVE-2026-60074 — High (CVSS 7.5): Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric…
- CVE-2026-49942 — High (CVSS 7.3): Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could…
- CVE-2024-45179 — High (CVSS 7.2): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input…