Sandbox resource exhaustion — uncontrolled CPU/memory consumption in untrusted templates
CVE-2026-46627 is a moderate-severity uncontrolled resource consumption (CWE-400) issue in the Twig templating engine's sandbox. The sandbox is designed to prevent untrusted templates from reaching code, data, methods, or properties they shouldn't — but it does not restrict how much CPU, memory, or execution time a template may consume.
An untrusted template can exhaust host resources even with the sandbox active and strict allow-lists in place, leading to denial-of-service conditions through:
Denial of service. The sandbox bounds what a template can touch, not how much work it can demand. An attacker who can supply template source — for example, a product that lets users author Twig snippets — can render the host unresponsive without ever escaping the sandbox.
Twig 3.26.0 documents this as an intentional design limitation rather than a fixable template-level bug. The protection is process-level containment, not sandbox configuration:
memory_limit and max_execution_timeulimit)The takeaway for reviewers: a sandbox is an access-control boundary, not a resource-control boundary. If your threat model includes untrusted template authors, resource limits must live in the runtime around Twig, not inside it.
Reported by Kai Aizen (SnailSploit). Status: Published. Coordinated with the Twig maintainers; resolved in 3.26.0 with documented process-level mitigations.
An uncontrolled-resource-consumption issue (CWE-400) in the Twig templating engine's sandbox. The sandbox prevents untrusted templates from reaching code, data, methods, or properties they shouldn't — but it does not restrict how much CPU, memory, or execution time a template can consume. Large ranges, nested loops, string operations, recursive macros, and expensive filters can exhaust resources.
You are affected if your application renders untrusted, user-supplied Twig templates and relies on the sandbox as the only protection. Affected versions are twig/twig before 3.26.0. If templates are authored only by trusted developers, the practical risk is low.
Twig 3.26.0 documents this as a design limitation. The fix is process-level containment: set PHP memory_limit and max_execution_time, render untrusted templates in isolated worker processes, and apply OS-level resource limits (cgroups, ulimits). Do not rely on the sandbox alone to bound resource use.
Denial of service. An untrusted template can exhaust CPU, memory, or execution time on the rendering host despite an active sandbox with strict allow-lists. Severity is Moderate.
The Twig GitHub Security Advisory GHSA-923g-j88x-j34q, the MITRE CVE record for CVE-2026-46627, and the NVD detail page once published.