CVE-2026-46629·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.30% — higher than 23% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Update PHP and the Twig templating engine to version 3.26.0 or later to resolve memory exhaustion risks in the intl-extra extension. The vulnerability allows template authors to trigger excessive allocation of formatter objects that persist for the lifetime of the Twig environment, potentially leading to denial of service. Apply security patches through your distribution's package manager as soon as possible.

sudo dnf update php

How to check if you are affected

1. Step 1: Check the installed PHP version by running: php -v
2. Step 2: Verify if Twig is installed and its version by running: composer show twig/twig or grep -r 'twig/twig' composer.lock
3. Step 3: Search application logs for evidence of template injection or unusual locale/pattern filter arguments in Twig template rendering: grep -i 'intl\|locale\|pattern' /var/log/application.log
4. Step 4: After patching, confirm PHP version is >= 5.x with Twig >= 3.26.0 by running: php -v && composer show twig/twig | grep Version

FAQ

Related PHP CVEs

References

• https://github.com/twigphp/Twig/commit/6add9066fc5c0455eb764c1f3af6e4e4e3562419
• https://github.com/twigphp/Twig/releases/tag/v3.26.0
• https://github.com/twigphp/Twig/security/advisories/GHSA-35wc-cvqg-78fp