Security Advisory
CVE-2026-46629
6.5
MEDIUM
Vulnerability Description
Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned for the lifetime of the Twig\Environment. This issue is fixed in version 3.26.0.
Published Date
July 14, 2026
Official Source
NIST NVD Advisory