Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-46629

Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned for the lifetime of the Twig\Environment. This issue is fixed in version 3.26.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

twigphp Twig

  • < 3.26.0affected

References