CVE-2026-55865CWE-835

Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

High · published July 9, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {% case %} tag without an associated {% when %} or {% else %} block and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give the EOF token matching kind and value fields, allowing malicious template authors to craft templates for a denial of service attack. This issue is fixed in version 2.2.1.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-07-09T20:34Z
EPSS history
Timeline
  • 09 JUL 20:34Z
    Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
    cvelistv5