Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M

CVE-2026-46627Twig: Sandbox resource exhaustion via unbounded `for` / `range()`

High 7.1

In plain English

A high-severity uncontrolled resource consumption in Twig from twigphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.5%top 54.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	php-twig	no fix listed	DEBIAN-CVE-2026-46627
Debian:13	php-twig	3.27.0-0+deb13u1	DEBIAN-CVE-2026-46627
Debian:14	php-twig	3.26.0-1	DEBIAN-CVE-2026-46627
Ubuntu:25.10	php-twig	no fix listed	UBUNTU-CVE-2026-46627
Ubuntu:26.10	php-twig	no fix listed	UBUNTU-CVE-2026-46627

Affected products (as reported)

Vendor	Product	Versions
twigphp	Twig	< 3.26.0

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/twigphp/Twig/security/advisories/GHSA-923g-j88x-j34q x_refsource_CONFIRM
https://github.com/twigphp/Twig/commit/6bfa285e2f98651adb7aa480bf83a741d154f09f x_refsource_MISC
https://github.com/twigphp/Twig/releases/tag/v3.26.0 x_refsource_MISC