symfony/polyfill vulnerabilities (Packagist)

2 vulnerabilities.

• symfony/polyfill Packagist symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence CVE-2026-46644 Fix available 6.9 MediumMay 28, 2026
• symfony/polyfill Packagist Symfony Denial of Service Via Long Password Hashing CVE-2013-5958 Fix available 5.0 MediumDecember 27, 2014