Executive brief
Twig is a popular template engine for PHP used to generate web pages. A vulnerability in its sandbox mode allows untrusted templates to consume excessive system resources like CPU and memory. This can lead to a denial-of-service (DoS) condition, potentially crashing the application or making the website unavailable to users.
Technical details
Twig's sandbox mode, designed to safely execute untrusted templates, fails to implement resource usage limits. An attacker with the ability to provide or modify templates can utilize features like large ranges, nested loops, recursive macros, or expensive filters to exhaust system resources (CPU, memory, and wall-clock time). This is classified as CWE-400 (Uncontrolled Resource Consumption). The maintainers have addressed this in version 3.26.0 by documenting that the sandbox is not intended to provide resource isolation and recommending that users implement process-level constraints (e.g., PHP's memory_limit or OS-level limits) instead.
Affected products
- twigphp Twig < 3.26.0
Timeline
- 2026-05-20: patched: Version 3.26.0 released with updated documentation and security notes.
- 2026-07-14: disclosed: CVE-2026-46627 published.