The vulnerability in symfony/polyfill-intl-idn (versions >=1.17.1 <1.38.1) arises from improper validation of Punycode labels in domain names. The Idn::process() function does not enforce the UTS #46 revision 33 requirement that decoded ACE labels must contain at least one non-ASCII code point. As a result, xn-- labels with empty or ASCII-only payloads are accepted, causing originally unequal domain names to be treated as equal. This can lead to security issues such as blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications that use this polyfill for hostname processing. The vulnerability is fixed in version 1.38.1.

Applications using symfony/polyfill-intl-idn versions from 1.17.1 to before 1.38.1 may incorrectly treat distinct domain names as equivalent due to improper validation of Punycode labels. This can enable attackers to bypass domain-based blacklists, cause inconsistent URL parsing, and potentially perform server-side request forgery attacks. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality and integrity.

Upgrade symfony/polyfill-intl-idn to version 1.38.1 or later, where the issue is fixed. No other temporary or official fixes are documented. Patch status is not explicitly stated beyond the fixed version, so users should verify with the vendor advisory for the latest remediation guidance.