CVE-2026-46627: Sandbox does not protect against resource exhaustion
Sandbox does not protect against resource exhaustion
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 3.26.0 - Upgrade
Upgrade
debian/php-twigto a version that resolves this vulnerability.Fixed in 3.27.0-0+deb13u1Fixed in 3.30.0-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.26.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46627?
CVE-2026-46627 has a high severity rating of 7.1 according to the CVSS scoring system.
How do I fix CVE-2026-46627?
To fix CVE-2026-46627, upgrade Twig to version 3.26.0 or later.
What is the impact of CVE-2026-46627?
CVE-2026-46627 allows untrusted templates to cause resource exhaustion, leading to potential denial of service.
Which versions of Twig are affected by CVE-2026-46627?
All versions of Twig prior to 3.26.0 are affected by CVE-2026-46627.
Is Symfony Twig affected by CVE-2026-46627?
Yes, Symfony Twig is affected by CVE-2026-46627, as it relies on the Twig template language.