CyberRota Analysis
AI-GeneratedTwig's template language for PHP versions prior to 3.26.0 is vulnerable to resource exhaustion due to inadequate restrictions in its sandbox environment, which allows untrusted templates to consume excessive CPU, memory, or wall-clock time. This can lead to denial-of-service conditions, impacting application performance and availability. Developers and organizations using affected versions should prioritize upgrading to 3.26.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.
Related CVEs
Other vulnerabilities affecting the same vendor(s)