EUVD-2026-44559Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess template-rendering feature
-
DeliverySubmit malicious Twig template
-
ExploitTrigger nested loops/recursive macros
-
ExecutionExhaust CPU and memory
-
ImpactWorker killed / service denied
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application render untrusted, attacker-influenced Twig templates - the vulnerable path is the Twig sandbox itself, and crucially the sandbox being enabled provides NO protection here. The attacker needs the ability to author or inject template source (reflected by PR:L), so applications that render only trusted, developer-authored templates are not exposed. What limits exploitation: the attacker must reach a template-rendering feature, the impact is availability-only (no data disclosure or code execution), and any process-level resource caps already in place (memory_limit, execution timeouts, cgroups) directly blunt or neutralize the attack. No user interaction is required and the attack is network-reachable with low complexity where template submission is exposed. |
| Impact | This is a genuine but bounded (availability-only) risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:N/VI:N/VA:H) scores 7.1 and correctly reflects a network-reachable, low-complexity attack whose sole impact is availability, requiring low privileges - meaning the attacker must have some ability to submit or influence the template being rendered. All exploitation signals point to low urgency: SSVC records Exploitation=none, Automatable=no, Technical Impact=partial; EPSS is 0.33% (25th percentile); and it is not KEV-listed with no public exploit code. A key nuance: the PR:L in the vector implies the attacker needs template-authoring capability, so real-world exposure hinges entirely on whether an application actually exposes template rendering to untrusted input - most deployments render only developer-authored templates and are effectively not exposed. This is therefore a design-limitation advisory to be aware of, not an emergency patch priority. |
| Exploit ScenarioDerived | An application lets users supply or edit Twig templates (e.g. a SaaS email/report builder) and renders them server-side within the sandbox, trusting the allow-list for safety. An attacker submits a template with deeply nested loops over a large range or a recursive macro, and rendering pins a CPU core and inflates memory until the worker is killed or times out, degrading or denying service for other tenants. No public proof-of-concept is identified, but the technique is trivial to construct given low-complexity network access and template-submission privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Denial-of-service via resource exhaustion affects the Twig templating engine for PHP prior to 3.26.0, where the sandbox - even under its strictest allow-list - does not bound CPU, memory, or wall-clock consumption of a rendered template. Any application that renders untrusted or user-supplied templates can be forced to exhaust host resources through large ranges, nested loops, recursive macros, or expensive filters. There is no public exploit identified and it is not in CISA KEV; EPSS is low (0.33%), and the vendor's 3.26.0 'fix' only documents the limitation rather than adding a code-level control.
RemediationAI
Vendor-released patch: 3.26.0 - but note this release is a documentation change (commit 6bfa285e2f98651adb7aa480bf83a741d154f09f updates doc/sandbox.rst), not a functional mitigation; upgrading does not add any resource limit. Because Twig explicitly declines to enforce limits at the engine level (any built-in cap being 'arbitrary and trivial to work around'), the effective remediation is process-level containment of untrusted template rendering: run rendering in an isolated worker/process with hard caps via PHP settings (memory_limit, max_execution_time) and OS controls (ulimit, cgroups CPU/memory quotas), and enforce request timeouts at the web/app server. Where feasible, avoid rendering attacker-controlled templates at all, or constrain inputs (limit loop/range sizes, template length, include depth) before rendering. Trade-off: aggressive memory_limit/timeout caps can terminate legitimate large renders, so tune per workload. See GHSA-923g-j88x-j34q for the vendor's guidance to 'contain them at the process level rather than at the template engine level.'
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Twig compiles template source into PHP and offers a sandbox mode to safely render untrusted templates by restricting which tags, filters, functions, methods, and properties are reachable. The sandbox is an access-control boundary, not a resource-control boundary - it governs WHAT a template may touch, not HOW MUCH compute it may consume. This maps directly to CWE-400 (Uncontrolled Resource Consumption): constructs that are individually permitted (loops, ranges, string operations, macro recursion, includes) can be composed to burn unbounded CPU/memory/time. The affected component per CPE is cpe:2.3:a:symfony:twig, i.e. the twigphp/Twig library, historically maintained under the Symfony ecosystem and embedded in frameworks such as Symfony and Drupal.
Know when Twig gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable, low-complexity DoS requiring template-submission privileges (PR:L); no confidentiality or integrity impact, availability-only (A:H), scope unchanged.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
Executive ViewAI
Twig templating engine (PHP versions prior to 3.26.0) contains a denial-of-service vulnerability enabling resource exhaustion when rendering untrusted templates-a critical risk for platforms accepting user-generated content or dynamic templates. Without CPU, memory, or execution-time limits in Twig's sandbox, attackers can crash or severely degrade service availability through crafted templates with loops, macros, or expensive filters. No public exploit identified at time of analysis, with current exploit probability at 0.3%, but immediate assessment of template-handling practices is required to prevent potential service disruption.
Vendor-released patch: Twig 3.26.0 (note: this release documents the limitation rather than implementing code-level mitigations). Interim controls: (1) Enforce per-application resource limits (max_execution_time, memory_limit) at the PHP/script level; (2) Prefer pre-approved, whitelisted templates over dynamic user-supplied templates; (3) Implement request-level rate limiting and timeouts on template rendering operations; (4) Monitor server resource consumption (CPU, memory) for anomalous spikes; (5) Deploy WAF rules to detect and reject templates with characteristics of resource-exhaustion attacks (e.g., loops with large ranges, deeply nested macros, expensive filters).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. Rated critical sever
Sandbox bypass in Twig template engine versions 2.16.x and 3.9.0 through 3.25.x allows attackers with template rendering
Twig is a template language for PHP. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no auth
Twig is a template language for PHP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no auth
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote at
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Rated medium severity
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it
Exploit-DB