CVE-2026-55865 Details
Description
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {% case %} tag without an associated {% when %} or {% else %} block and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give the EOF token matching kind and value fields, allowing malicious template authors to craft templates for a denial of service attack. This issue is fixed in version 2.2.1.
A denial-of-service vulnerability has been identified in Python Liquid versions prior to 2.2.1. The issue arises when a malformed '{% case %}' tag is used without an accompanying '{% when %}' or '{% else %}' block, and lacks a closing '{% endcase %}' tag. This combination causes the parser to enter an infinite loop during processing, as the 'liquid.TokenStream.eof' did not provide the correct EOF token matching kind and value. Malicious template authors can exploit this flaw by crafting specific templates that trigger the infinite loop, leading to a denial-of-service condition.
Users can upgrade to Python Liquid version 2.2.1 or later, where this issue has been fixed. The vulnerability can also be manually addressed by correcting the 'liquid.TokenStream.eof' definition before parsing templates.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jg-rp/liquid/commit/26db8931cf35e8433c1ca506fc32c3bb62f743d4 | [email protected] | Source CodeVendor |
| https://github.com/jg-rp/liquid/releases/tag/v2.2.1 | [email protected] | Release NotesVendor |
| https://github.com/jg-rp/liquid/security/advisories/GHSA-vq2f-vcc9-j8mv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Python Liquid | < 2.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |