CyberRota Analysis
AI-GeneratedThe Symfony Polyfill library versions 1.17.1 to 1.38.1 are vulnerable due to improper handling of Punycode labels, allowing for the acceptance of labels that either have empty payloads or decode to ASCII-only code points. This flaw can lead to security risks such as blacklist bypassing, inconsistent URL parsing, and potential server-side request forgery in applications that rely on this polyfill for hostname canonicalization or comparison. Developers and security teams using affected versions should prioritize upgrading to version 1.38.1 to mitigate these vulnerabilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.38.1.