CVE-2026-46627: Twig: Sandbox resource exhaustion via unbounded `for` / `range()`

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-10-24
Weakness: CWE-400

Description

Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.

Affected products

twigphp Twig: before 3.26.0 — fixed in 3.26.0

How to fix

Upgrade to a fixed version: twigphp Twig 3.26.0. Check the vendor advisory for mitigations.

References

https://github.com/twigphp/Twig/commit/6bfa285e2f98651adb7aa480bf83a741d154f09f
https://github.com/twigphp/Twig/releases/tag/v3.26.0
https://github.com/twigphp/Twig/security/advisories/GHSA-923g-j88x-j34q

Get alerted when CVE-2026-46627 or the next vulnerability affects your stack