AIKIDO-2026-10960

TL;DR

The symfony/polyfill-intl-idn library provides userland idn_to_ascii() and idn_to_utf8() when PHP lacks the intl extension. Its Idn::process() method decodes xn-- Punycode labels but previously accepted payloads that decode to an empty string or to ASCII-only text. Pre-fix, originally unequal hostnames can be treated as equal while native ext-intl rejects them, which can break hostname blacklists and URL canonicalization in downstream applications. Version 1.38.1 records IDNA_ERROR_INVALID_ACE_LABEL for those labels, matching UTS #46 revision 33 and native ext-intl behavior.