CyberRota Analysis
AI-GeneratedTwig versions prior to 3.26.0 are vulnerable due to improper memoization of IntlDateFormatter and NumberFormatter instances, which can lead to excessive memory allocation from template-controlled filter arguments. This vulnerability may allow an attacker to exploit the application by causing resource exhaustion, potentially impacting performance and availability. Developers and organizations using affected versions of Twig should prioritize upgrading to version 3.26.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned for the lifetime of the Twig\Environment. This issue is fixed in version 3.26.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)