CVE-2026-46629: Symfony Twig Memory Exhaustion Vulnerability

CVE-2026-46629 Overview

CVE-2026-46629 affects Twig, a widely deployed template language for PHP. The twig/intl-extra package memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments. These arguments include locale, pattern, and attrs. A template author can trigger allocation of many International Components for Unicode (ICU) formatter objects that remain pinned for the lifetime of the Twig\Environment. The result is uncontrolled resource consumption [CWE-770] leading to memory exhaustion. Symfony fixed the issue in Twig version 3.26.0.

Critical Impact
Authenticated template authors can exhaust server memory by forcing the allocation of unbounded ICU formatter instances that persist for the Twig environment lifetime.

Affected Products

Symfony Twig versions prior to 3.26.0
twig/intl-extra package (all versions prior to 3.26.0)
PHP applications using Twig with the Intl extension enabled

Discovery Timeline

2026-07-14 - CVE-2026-46629 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-46629

Vulnerability Analysis

The vulnerability resides in the twig/intl-extra component, which provides localization filters for Twig templates. The extension caches IntlDateFormatter and NumberFormatter objects to avoid repeated ICU allocation costs. The cache uses associative arrays keyed by filter argument values passed directly from templates.

Each unique combination of locale, pattern, and attrs produces a distinct cache entry. Because template authors control these arguments, they can generate an unbounded number of cache keys. Every new key allocates a fresh ICU formatter object that the garbage collector cannot reclaim.

The cached instances remain pinned to the Twig\Environment for its entire lifetime. In long-running PHP processes such as PHP-FPM workers, FrankenPHP, or RoadRunner deployments, memory consumption grows until the process exhausts available heap.

Root Cause

The root cause is missing bounds on the memoisation cache. The extension trusts that filter arguments come from a small, fixed set of application-controlled values. When templates accept user input into these arguments, that assumption fails.

Attack Vector

An attacker with the ability to author or influence Twig templates can construct filters that vary the locale, pattern, or attrs on each invocation. Repeated rendering forces continuous formatter allocation. The vulnerability requires low privileges and no user interaction. The impact is limited to availability through memory exhaustion.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-35wc-cvqg-78fp. No public proof-of-concept exploit exists at the time of publication.

Detection Methods for CVE-2026-46629

Indicators of Compromise

Steady growth in PHP worker process memory consumption without corresponding request volume growth
Out-of-memory errors from PHP-FPM, FrankenPHP, or RoadRunner processes rendering Twig templates
Elevated request rates targeting endpoints that render templates with format_date, format_number, or related intl filters using variable arguments

Detection Strategies

Audit Twig templates for use of format_date, format_datetime, format_time, format_number, and format_currency filters that accept template variables in the locale, pattern, or attrs arguments
Inventory installed twig/intl-extra package versions across PHP applications and flag any release earlier than 3.26.0
Instrument PHP worker memory metrics and alert on sustained growth patterns consistent with cache pinning

Monitoring Recommendations

Track resident set size (RSS) per PHP worker over time and correlate spikes with Twig rendering endpoints
Log the diversity of locale and pattern values passed to intl filters to identify anomalous variance
Configure PHP memory_limit alerts and worker recycling thresholds to contain exhaustion attempts

How to Mitigate CVE-2026-46629

Immediate Actions Required

Upgrade Twig and twig/intl-extra to version 3.26.0 or later using Composer
Review all Twig templates that pass user-controlled data into intl formatting filters and restrict allowed values
Configure PHP-FPM pm.max_requests to recycle workers periodically as a defense-in-depth measure

Patch Information

Symfony released the fix in Twig 3.26.0. The patch is available in the upstream commit 6add9066. Release notes are documented in the GitHub Release v3.26.0. Apply the update via composer update twig/twig twig/intl-extra.

Workarounds

Validate and allowlist locale, pattern, and attrs values before passing them to intl filters in templates
Disable the twig/intl-extra extension if localization filters are not required by the application
Recycle long-running PHP worker processes on a schedule to release accumulated formatter caches

bash

# Configuration example
composer require twig/twig:^3.26.0 twig/intl-extra:^3.26.0
composer update twig/twig twig/intl-extra