symfony/polyfill

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

1. Low, CVSS 2.7PackagistPublished 28 May 2026

   symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

   CVE-2026-46644 · GHSA-2xf4-cg6j-vhgq

   Affected

   • Packagist symfony/polyfill >= 1.17.1, < 1.38.1

   Fixed in

   1.38.1· Vendor fix available

   Issue

   symfony/polyfill-intl-idn provides a userland implementation of idntoutf8() and idntoascii() for runtimes that lack the intl extension. Its Idn::process() method decodes labels prefixed with xn-- using Punycode but never enforces the validity criterion added in UTS #46 revision 33 Section 4 step 4.1.2: after a successful Punycode decode, the result must contain at least one non-ASCII code point. As a consequence, xn-- labels whose Punycode payload is empty (xn--) or decodes to a string made of only ASCII code points (e.g. xn--kc1zs4-) are accepted by the polyfill while PHP's native ext-intl rejects them with IDNAERRORINVALIDACELABEL. Originally unequal domain names are therefore regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing and server-side request forgery (similar to CVE-2024-12224). Example with IDNAUSESTD3RULES | IDNACHECKBIDI | IDNACHECKCONTEXTJ | IDNANONTRANSITIONALTOASCII: | Input | Polyfill output | Native ext-intl output | | ---…

   Recommended action: Upgrade to 1.38.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 14:48 UTCEvidence →
2. UnratedPackagistPublished 17 May 2022

   Symfony Denial of Service Via Long Password Hashing

   CVE-2013-5958 · GHSA-cr49-fx2v-9p57

   Affected

   • Packagist symfony/polyfill >= 1.0.0, < 1.10.0

   Fixed in

   1.10.0· Vendor fix available

   Issue

   The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750.

   Recommended action: Upgrade to 1.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 14:20 UTCEvidence →