Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔐 CVE-2026-46627: Sandbox does not protect against resource exhaustion ➡️ https://symfony.com/blog/cve-2026-46627-sandbox-does-not-protect-against-resource-exhaustion
Post summary
The tweet announces the disclosure of CVE-2026-46627, describing a resource exhaustion flaw in Symfony’s sandbox, and directs readers to the vendor’s blog for full details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | symfony | twig | - | - | - |