CVE-2026-46627

תיאור (מקור, אנגלית)

Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.

מדדים

CVSS 3.1

6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 4.0

7.1 (HIGH) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-8/8/2026

CWE

CWE-400

מוצרים מושפעים

symfony: twig

קישורים

• https://github.com/twigphp/Twig/security/advisories/GHSA-923g-j88x-j34q Vendor Advisory
• https://github.com/twigphp/Twig/commit/6bfa285e2f98651adb7aa480bf83a741d154f09f Patch
• https://github.com/twigphp/Twig/releases/tag/v3.26.0 Release Notes