CVE-2026-46629

Analyzed Analyzed - Analysis Complete

Twig Intl-Extra Memory Exhaustion via Template-Controlled Formatters

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned for the lifetime of the Twig\Environment. This issue is fixed in version 3.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-46629

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	to 3.26.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

Twig is a PHP template language. Before version 3.26.0, it had a flaw where it stored IntlDateFormatter and NumberFormatter objects in memory using keys controlled by template filter arguments like locale or pattern. This allowed templates to create many ICU formatter objects that remained in memory for the entire lifetime of the Twig environment.

Detection Guidance

Detection involves checking Twig version and monitoring for excessive ICU formatter allocations. Check Twig version with composer show twig/twig. Monitor for high memory usage or formatter object counts in PHP processes.

Impact Analysis

An attacker could exploit this to cause excessive memory usage by forcing the creation of many formatter objects. This may lead to denial of service due to resource exhaustion or degraded performance in applications using vulnerable Twig versions.

Compliance Impact

The vulnerability allows a template to allocate many ICU formatter objects that remain pinned for the lifetime of the Twig environment. This could lead to resource exhaustion or denial-of-service conditions, potentially impacting system availability and integrity.

Mitigation Strategies

Upgrade Twig to version 3.26.0 or later. Review templates using intl-extra filters to ensure locale and pattern arguments are not user-controlled. Monitor system resources for unusual formatter allocations.

Hi! I’m here to help you understand CVE-2026-46629. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70