Most recent entries from all

fkie_cve-2026-46629

2026-09-29T19:36:10.174158+00:00

Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned for the lifetime of the Twig\Environment. This issue is fixed in version 3.26.0.

GHSA-35wc-cvqg-78fp — twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments

2026-09-29T19:36:10.174291+00:00

Affected: Packagist: twig/intl-extra

### Description

`IntlExtension` memoises every `\IntlDateFormatter` and `\NumberFormatter` it creates in instance-level arrays keyed on a hash that includes `locale`, `pattern`, `attrs` and other values that are ordinary named arguments of the `format_datetime` / `format_date` / `format_time` / `format_number` / `format_currency` filters. There is no size limit and no eviction.

A template that iterates over many distinct `pattern` (or `locale`, or `grouping_used`, ...) values therefore allocates one ICU formatter object per distinct value and pins it for the entire lifetime of the `Twig\Environment`. Because ICU allocates its backing buffers outside the Zend memory manager, this growth is not bounded by `memory_limit`. On long-running runtimes (RoadRunner, Swoole, FrankenPHP worker mode, ReactPHP) where the `Environment` outlives a single request, the cache also accumulates across requests.

### Resolution

The formatter caches are now bounded in size (100 entries each) and evict on a FIFO basis.

### Credits

Twig would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

UBUNTU-CVE-2026-46629

2026-09-29T19:36:10.174371+00:00

Affected: Ubuntu:Pro:20.04:LTS: php-twig, Ubuntu:Pro:22.04:LTS: php-twig, Ubuntu:Pro:24.04:LTS: php-twig, Ubuntu:25.10: php-twig, Ubuntu:Pro:26.04:LTS: php-twig