# CVE-2026-46627: Twig resource exhaustion in sandbox mode

Source: https://junglewise.ai/threats/cve-2026-46627-twig-resource-exhaustion-in-sandbox-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-46627 · Severity: info · CVSS 7.1 · Published 2026-07-14

Twig is a popular template engine for PHP used to generate web pages. A vulnerability in its sandbox mode allows untrusted templates to consume excessive system resources like CPU and memory. This can lead to a denial-of-service (DoS) condition, potentially crashing the application or making the website unavailable to users.

## Quick answers

**Is CVE-2026-46627 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46627 being exploited in the wild.

**How severe is CVE-2026-46627?** Informational severity, with a CVSS score of 7.1, published 14 July 2026.

**Which products and versions are affected?** twigphp Twig < 3.26.0.

**Is there a fix for CVE-2026-46627?** A patch was published on 2026-05-20: Version 3.26.0 released with updated documentation and security notes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46627 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46627?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Twig's sandbox mode, designed to safely execute untrusted templates, fails to implement resource usage limits. An attacker with the ability to provide or modify templates can utilize features like large ranges, nested loops, recursive macros, or expensive filters to exhaust system resources (CPU, memory, and wall-clock time). This is classified as CWE-400 (Uncontrolled Resource Consumption). The maintainers have addressed this in version 3.26.0 by documenting that the sandbox is not intended to provide resource isolation and recommending that users implement process-level constraints (e.g., PHP's memory_limit or OS-level limits) instead.

## Affected products

- twigphp Twig < 3.26.0

## Timeline

- 2026-05-20: patched: Version 3.26.0 released with updated documentation and security notes.
- 2026-07-14: disclosed: CVE-2026-46627 published.

## References

- [https://github.com/twigphp/Twig/commit/6bfa285e2f98651adb7aa480bf83a741d154f09f](https://github.com/twigphp/Twig/commit/6bfa285e2f98651adb7aa480bf83a741d154f09f)
- [https://github.com/twigphp/Twig/releases/tag/v3.26.0](https://github.com/twigphp/Twig/releases/tag/v3.26.0)
- [https://github.com/twigphp/Twig/security/advisories/GHSA-923g-j88x-j34q](https://github.com/twigphp/Twig/security/advisories/GHSA-923g-j88x-j34q)