CVE-2026-46627CWE-400

Twig: Sandbox resource exhaustion via unbounded `for` / `range()`

High · published July 14, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00542 · 44.8th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-07-14T21:15Z
EPSS history
Timeline
  • 14 JUL 21:15Z
    Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
    cvelistv5