CVE-2026-46627
Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
- Record
CVE-2026-46627- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-44559
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
- Record
EUVD-2026-44559- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
- Record
CVE-2026-46627- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
- Record
CVE-2026-46627- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-46627
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
- Record
DEBIAN-CVE-2026-46627- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-46627
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
- Record
UBUNTU-CVE-2026-46627- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php-twigDebian:12 |
All versions, plus listed versions 3.10.1-13.10.3-13.11.0-13.13.0-13.14.0-1 Show 45 moreShow less3.14.0-23.14.0-33.14.0-43.14.2-13.14.2-23.14.2-33.15.0-13.15.0-23.17.1-13.17.1-23.18.0-13.18.0-23.18.0-43.18.0-53.18.0-63.18.0-73.19.0-13.19.0-1~bootstrap3.20.0-13.20.0-1~bootstrap3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-13.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-13.26.0-13.27.0-13.27.1-13.28.0-13.5.1-13.5.1-1+deb12u13.5.1-1+deb12u23.5.1-1+deb12u33.6.0-13.6.1-13.7.0-1 |
None known |
php-twigDebian:13 |
before 3.27.0-0+deb13u1, plus listed versions 3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-1 Show 11 moreShow less3.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-13.26.0-0+deb13u13.26.0-1 |
3.27.0-0+deb13u1 |
php-twigDebian:14 |
before 3.26.0-1, plus listed versions 3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-1 Show 9 moreShow less3.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-1 |
3.26.0-1 |
php-twigUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.11.3-22.12.1-12.12.2-12.12.3-12.12.5-12.12.5-1ubuntu0.1~esm12.12.5-1ubuntu0.1~esm2 |
None known |
php-twigUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.3.2-1ubuntu33.3.4-13.3.6-13.3.7-13.3.8-2ubuntu43.3.8-2ubuntu4+esm13.3.8-2ubuntu4+esm2 |
None known |
php-twigUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.7.0-13.7.1-13.8.0-23.8.0-2ubuntu0.1~esm13.8.0-2ubuntu13.8.0-2ubuntu1+esm1 |
None known |
php-twigUbuntu:25.10 |
All versions, plus listed versions 3.20.0-2ubuntu1 |
None known |
php-twigUbuntu:26.10 |
All versions, plus listed versions 3.23.0-2build73.27.1-13.28.0-1 |
None known |
php-twigUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 3.20.0-2ubuntu13.23.0-2build53.23.0-2build73.23.0-2ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-46627 is a high vulnerability (CVSS 7.1) in Symfony Twig, published July 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in php-twig 3.27.0-0+deb13u1.
References
github.com/twigphp/Twig/security/advisories/GHSA-923g-j88x-j34q
nvd.nist.gov/vuln/detail/CVE-2026-46627
security-tracker.debian.org/tracker/CVE-2026-46627
ubuntu.com/security/CVE-2026-46627
cve.org/CVERecord?id=CVE-2026-46627
symfony.com/blog/cve-2026-46627-sandbox-does-not-protect-against-resource-exhaustion
Left out here: 9 versions. The JSON record has them.