Twig is a templating engine for PHP. A flaw in older releases before 3.26.0 lets the twig/intl-extra extension cache IntlDateFormatter and NumberFormatter objects in arrays keyed by arguments supplied by the template such as locale, pattern, and attributes. The keys come directly from template input, so an attacker can cause an unbounded number of formatter instances that persist for the lifetime of the Twig environment. The uncontrolled growth can exhaust heap memory, leading to a denial of service. This is an instance of resource exhaustion (CWE‑770).

The vulnerability affects twigphp's Twig product. All releases older than 3.26.0 are susceptible; the issue is fixed in 3.26.0 and newer versions.

The flaw carries a CVSS score of 5.3, indicating medium severity, while the EPSS score of less than 1% signals a low historical exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires only the ability to supply a template or template arguments, no special privileges. Based on the description, the likely attack vector is an application that renders user‑controlled templates or passes user‑controlled values to the intl filters, which can trigger memory exhaustion and service interruption.