CVE-2026-46627
Analyzed Analyzed - Analysis Complete

Twig Template Engine Resource Exhaustion Vulnerability

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-14
Last Modified
2026-07-16
Generated
2026-08-04
AI Q&A
2026-07-15
EPSS Evaluated
2026-08-02
NVD
CVE-2026-46627

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
symfony twig to 3.26.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Twig is a template language for PHP. Prior to version 3.26.0, the Twig sandbox fails to prevent untrusted templates from consuming excessive CPU, memory, or time, even with strict allow-lists. This allows resource exhaustion attacks.

Detection Guidance

This vulnerability cannot be directly detected via commands as it involves resource exhaustion in Twig templates. Monitor system resources like CPU, memory, and execution time during template rendering. Check Twig version with composer show twig/twig to verify if it is below 3.26.0.

Impact Analysis

An attacker could craft a malicious template to consume excessive server resources, leading to degraded performance, crashes, or denial of service for applications using affected Twig versions.

Compliance Impact

Resource exhaustion may lead to system unavailability, violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Downtime could also impact data integrity and access controls.

Mitigation Strategies

Upgrade Twig to version 3.26.0 or later to address the resource exhaustion issue. Ensure untrusted templates are sandboxed and limit execution time and memory usage for template rendering processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46627. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart