EUVD-2026-44559Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity DoS requiring template-submission privileges (PR:L); no confidentiality or integrity impact, availability-only (A:H), scope unchanged.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
AnalysisAI
Denial-of-service via resource exhaustion affects the Twig templating engine for PHP prior to 3.26.0, where the sandbox - even under its strictest allow-list - does not bound CPU, memory, or wall-clock consumption of a rendered template. Any application that renders untrusted or user-supplied templates can be forced to exhaust host resources through large ranges, nested loops, recursive macros, or expensive filters. There is no public exploit identified and it is not in CISA KEV; EPSS is low (0.33%), and the vendor's 3.26.0 'fix' only documents the limitation rather than adding a code-level control.
Technical ContextAI
Twig compiles template source into PHP and offers a sandbox mode to safely render untrusted templates by restricting which tags, filters, functions, methods, and properties are reachable. The sandbox is an access-control boundary, not a resource-control boundary - it governs WHAT a template may touch, not HOW MUCH compute it may consume. This maps directly to CWE-400 (Uncontrolled Resource Consumption): constructs that are individually permitted (loops, ranges, string operations, macro recursion, includes) can be composed to burn unbounded CPU/memory/time. The affected component per CPE is cpe:2.3:a:symfony:twig, i.e. the twigphp/Twig library, historically maintained under the Symfony ecosystem and embedded in frameworks such as Symfony and Drupal.
RemediationAI
Vendor-released patch: 3.26.0 - but note this release is a documentation change (commit 6bfa285e2f98651adb7aa480bf83a741d154f09f updates doc/sandbox.rst), not a functional mitigation; upgrading does not add any resource limit. Because Twig explicitly declines to enforce limits at the engine level (any built-in cap being 'arbitrary and trivial to work around'), the effective remediation is process-level containment of untrusted template rendering: run rendering in an isolated worker/process with hard caps via PHP settings (memory_limit, max_execution_time) and OS controls (ulimit, cgroups CPU/memory quotas), and enforce request timeouts at the web/app server. Where feasible, avoid rendering attacker-controlled templates at all, or constrain inputs (limit loop/range sizes, template length, include depth) before rendering. Trade-off: aggressive memory_limit/timeout caps can terminate legitimate large renders, so tune per workload. See GHSA-923g-j88x-j34q for the vendor's guidance to 'contain them at the process level rather than at the template engine level.'
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.1
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when servic
Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. Rated critical sever
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Rated high severity (C
Symfony versions up to 5.4.51 contains a vulnerability that allows attackers to operations being performed on an uninten
Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attacke
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty p
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. Rated critical sev
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Rated critical s
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. Rated critical severity (CVSS 9.8), this vulner
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Method
An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, a
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today