CVE-2026-46629CWE-770

Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

Medium · published July 14, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned for the lifetime of the Twig\Environment. This issue is fixed in version 3.26.0.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00542 · 44.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-14T21:22Z
EPSS history
Timeline
  • 14 JUL 21:22Z
    Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
    cvelistv5