The vulnerability in symfony/polyfill-intl-idn (versions >=1.17.1 <1.38.1) stems from improper validation of Punycode labels in domain names. Specifically, the Idn::process() function accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points, violating the UTS #46 revision 33 standard that requires at least one non-ASCII code point in decoded ACE labels. This improper validation can cause originally distinct domain names to be treated as equivalent, which may lead to security issues such as blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications relying on this polyfill for hostname canonicalization or comparison. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The issue is fixed starting from version 1.38.1.

Applications using symfony/polyfill-intl-idn versions >=1.17.1 and <1.38.1 may incorrectly treat distinct domain names as equal due to improper validation of Punycode labels. This can result in blacklist bypass, inconsistent URL parsing, and server-side request forgery vulnerabilities, potentially allowing attackers to circumvent security controls or manipulate hostname-based logic.

A fix for this vulnerability is available in symfony/polyfill-intl-idn version 1.38.1. Users should upgrade to version 1.38.1 or later to resolve the issue. Patch status is not explicitly stated beyond this version fix, so users should consult the vendor advisory or official Symfony resources for the latest remediation guidance.