Symfony Polyfill backports PHP features for internationalised domain names, but from version 1.17.1 until 1.38.1 the int‑idn polyfill accepts xn-- labels whose Punycode payload is empty or decodes only to ASCII code points because Idn::process does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non‑ASCII code point. This flaw allows malicious hostnames to be considered equivalent to benign ones, enabling blacklist bypass, inconsistent URL parsing, and potential server‑side request forgery in applications that rely on the polyfill for hostname canonicalisation.

The vulnerability affects the symfony/polyfill and symfony/polyfill-intl-idn packages, specifically all releases from version 1.17.1 up to and including 1.38.1. Versions 1.38.1 and later incorporate the fix.

With a CVSS score of 6.9, the flaw presents a medium severity risk. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending specially crafted punycode hostnames to applications that compare or normalise domain names using the affected polyfill, thereby bypassing security controls or redirecting traffic to malicious hosts. The risk remains significant enough that remediation is advised promptly and without reliance on basic defensive measures.