composer

symfony/polyfill-intl-idn

Security advisories for symfony/polyfill-intl-idn, newest first. 1 known, all fixed. If you’re on 1.38.1 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

1.43.0

Advisories

1 · 0 unfixed

Last advisory

26 May 2026

Safe from

1.38.1

1 advisory · newest first

LOW 26 May 2026

CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence

PKSA-dwsq-ppd2-mb1x · CVE-2026-46644

Affected

≥ 1.17.1, < 1.38.1

Fixed in

1.38.1

Published

26 May 2026

/advisories/composer/symfony/polyfill-intl-idn/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

symfony/cache3 advisories symfony/dom-crawler1 advisory symfony/error-handler1 advisory symfony/expression-language1 advisory symfony/http-client2 advisories symfony/http-foundation15 advisories symfony/http-kernel8 advisories symfony/mailer1 advisory

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →