Twig is a template language for PHP. Before version 3.26.0, the Twig sandbox fails to throttle CPU, memory, or wall‑clock consumption even when the strictest allow‑list is enforced. This flaw enables an attacker who can supply or control an untrusted template to execute unbounded `for` loops or `range()` constructs that exhaust server resources, resulting in a denial‑of‑service. The vulnerability is listed as CWE‑400.

The vulnerability affects the Twig template engine from the TwigPHP project. All installations using Twig earlier than version 3.26.0 are susceptible. Users who render untrusted templates with the strictest sandbox settings must be aware of this limitation.

The CVSS score of 7.1 represents the severity of the vulnerability, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker who can supply or control a Twig template rendered by the application, typically through user input or file uploads. The attack path relies on the sandbox’s inability to throttle resource usage, so the affected system must be able to process the template.