Executive brief
Twig, a popular template engine for PHP, contains a flaw in its internationalization extension that can lead to excessive memory consumption. By providing a large number of unique formatting options in a template, a user can force the server to store numerous data-formatting objects in memory indefinitely. This can lead to a denial-of-service condition where the application slows down or crashes due to resource exhaustion, especially in high-performance environments where the application stays running for long periods.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the Twig `intl-extra` extension due to unbounded memoization. The `IntlExtension` caches `IntlDateFormatter` and `NumberFormatter` instances in instance-level arrays using keys derived from template-controlled arguments like locale, pattern, and attributes. Because there is no size limit or eviction policy, an attacker with the ability to provide or influence template arguments can trigger the allocation of numerous ICU formatter objects. These objects are allocated outside the standard PHP memory manager, bypassing `memory_limit` restrictions. In long-running environments like RoadRunner or FrankenPHP, this leads to a memory leak across requests. The fix in version 3.26.0 implements a FIFO cache with a 100-entry limit.
Affected products
- twigphp Twig < 3.26.0
Timeline
- 2026-05-20: patched: Fixed in version 3.26.0
- 2026-05-20: advisory: GitHub Security Advisory GHSA-35wc-cvqg-78fp published
- 2026-07-14: disclosed: CVE-2026-46629 published to NVD