CVE-2026-46627 describes a resource exhaustion vulnerability in the Twig PHP template engine's sandbox prior to version 3.26.0. The sandbox feature, intended to restrict template behavior, does not prevent excessive consumption of CPU, memory, or wall-clock time by templates, even when strict allow-lists are applied. This allows untrusted templates to cause denial-of-service conditions through resource exhaustion. The vendor addressed this issue in version 3.26.0 by documenting the limitation of the sandbox rather than providing a technical fix.

Untrusted templates executed within the Twig sandbox can cause excessive CPU, memory, or wall-clock time consumption, potentially leading to denial-of-service conditions. This impacts applications that use the Twig sandbox to process untrusted templates, as they may be vulnerable to resource exhaustion attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Version 3.26.0 documents that the sandbox does not protect against resource exhaustion, implying no technical fix is provided. Users should consider alternative mitigations such as limiting resource usage at the system or application level, sandboxing execution environments, or avoiding untrusted templates. Monitor vendor communications for any future updates or fixes.