CVE-2026-46629: Twig resource exhaustion via unbounded memoization in intl-extra

CVE-2026-46629 · Severity: medium · CVSS 4 · Published 2026-07-14

Twig, a popular template engine for PHP, contains a flaw in its internationalization extension that can lead to excessive memory consumption. By providing a large number of unique formatting options in a template, a user can force the server to store numerous data-formatting objects in memory indefinitely. This can lead to a denial-of-service condition where the application slows down or crashes due to resource exhaustion, especially in high-performance environments where the application stays running for long periods.

Vendors: Packagist.

Quick answers

Is CVE-2026-46629 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46629 being exploited in the wild.
How severe is CVE-2026-46629?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
twig/intl-extra (Packagist) < 3.26.0, ECOSYSTEM:introduced=0,fixed=3.26.0; Twig Intl-Extra >= 2.12.0, < 3.26.0.
Is there a fix for CVE-2026-46629?
Yes. twig/intl-extra (Packagist): upgrade to 3.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46629 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46629?
Check whether you run twig/intl-extra (Packagist) or Twig Intl-Extra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • twig/intl-extra (Packagist): upgrade to 3.26.0 or later
    composer require twig/intl-extra:^3.26.0

Technical details

A resource exhaustion vulnerability (CWE-770) exists in the Twig `intl-extra` extension due to unbounded memoization. The `IntlExtension` caches `IntlDateFormatter` and `NumberFormatter` instances in instance-level arrays using keys derived from template-controlled arguments like locale, pattern, and attributes. Because there is no size limit or eviction policy, an attacker with the ability to provide or influence template arguments can trigger the allocation of numerous ICU formatter objects. These objects are allocated outside the standard PHP memory manager, bypassing `memory_limit` restrictions. In long-running environments like RoadRunner or FrankenPHP, this leads to a memory leak across requests. The fix in version 3.26.0 implements a FIFO cache with a 100-entry limit.

Affected products

  • twigphp Twig < 3.26.0

Identifiers

  • CVE-2026-46629
  • GHSA-35wc-cvqg-78fp

Timeline

  • 2026-05-20: patched: Fixed in version 3.26.0
  • 2026-05-20: advisory: GitHub Security Advisory GHSA-35wc-cvqg-78fp published
  • 2026-07-14: disclosed: CVE-2026-46629 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.