CVE-2026-46629 describes a resource allocation vulnerability in twigphp Twig prior to version 3.26.0. The intl-extra extension memoizes ICU formatter objects (IntlDateFormatter and NumberFormatter) in arrays keyed by template-controlled filter arguments such as locale, pattern, and attributes. Because these keys are controlled by templates, an attacker can cause Twig to allocate many formatter objects that remain pinned in memory for the lifetime of the Twig\Environment instance, potentially leading to resource exhaustion. This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The issue is fixed in Twig version 3.26.0.

An attacker who can control template filter arguments may cause Twig to allocate a large number of ICU formatter objects that remain in memory for the lifetime of the environment. This can lead to increased memory consumption and potential denial of service due to resource exhaustion. There is no indication of privilege escalation or code execution. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector with low privileges required and no user interaction needed.

Upgrade Twig to version 3.26.0 or later, where this vulnerability is fixed. No other official remediation or temporary workaround is provided. Patch status is confirmed fixed in 3.26.0.