PT-2026-42172 · Unknown · Intl-Extra

CVE-2026-46629 · Published 2026-05-20 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions twig/intl-extra (affected versions not specified)

Description IntlExtension memoises every IntlDateFormatter and NumberFormatter it creates in instance-level arrays. These arrays are keyed on a hash including locale, pattern, and attrs, which are named arguments for the format datetime, format date, format time, format number, and format currency filters. Because there is no size limit or eviction process, a template iterating over many distinct values allocates one ICU formatter object per value, pinning it for the lifetime of the TwigEnvironment. Since ICU allocates backing buffers outside the Zend memory manager, this growth is not restricted by memory limit. In long-running runtimes such as RoadRunner, Swoole, FrankenPHP worker mode, or ReactPHP, the cache accumulates across multiple requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-46629

GHSA-35WC-CVQG-78FP

Affected Products

Intl-Extra

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46629.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/intl-extra/CVE-2026-46629.yaml · Exploit
• https://github.com/twigphp/Twig/security/advisories/GHSA-35wc-cvqg-78fp · Vendor Advisory
• https://github.com/twigphp/Twig/commit/6add9066fc5c0455eb764c1f3af6e4e4e3562419 · Patch
• https://osv.dev/vulnerability/GHSA-35wc-cvqg-78fp · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-46629 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-46629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46629 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-46629 · Security Note
• https://osv.dev/vulnerability/CVE-2026-46629 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46629 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-46629 · Vendor Advisory
• https://github.com/twigphp/Twig/releases/tag/v3.26.0 · Note
• https://github.com/twigphp/Twig · Note
• https://twitter.com/symfony/status/2057046489772273677 · Twitter Post