CVE-2026-46627: Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Twig (PHP template language)to a version that resolves this vulnerability.Fixed in 3.26.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46627?
CVE-2026-46627 has a high severity rating of 7.1 according to the CVSS scoring system.
How do I fix CVE-2026-46627?
To fix CVE-2026-46627, upgrade Twig to version 3.26.0 or later.
What is the impact of CVE-2026-46627?
CVE-2026-46627 allows untrusted templates to cause resource exhaustion, leading to potential denial of service.
Which versions of Twig are affected by CVE-2026-46627?
All versions of Twig prior to 3.26.0 are affected by CVE-2026-46627.
Is Symfony Twig affected by CVE-2026-46627?
Yes, Symfony Twig is affected by CVE-2026-46627, as it relies on the Twig template language.