p PatchFirst

CVE-2026-55865

CVE-2026-55865 · Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {% case %} tag without an associated {% when %} or {% else %} block and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give the EOF token matching kind and value fields, allowing malicious template authors to craft templates for a denial of service attack. This issue is fixed in version 2.2.1.

CVSS 7.1 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • liquid

    Versions
    • < 2.2.1: Affected

    No fix published

  • python-liquid PyPI

    Versions
    • 0.10.0
    • 0.10.1
    • 0.11.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.5
    • 0.5.6
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.6.4
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.7.7
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.1.6
    • 1.1.7
    • 1.10.0
    • 1.10.2
    • 1.11.0
    • 1.12.0
    • 1.12.1
    • 1.12.2
    • 1.13.0
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.4.3
    • 1.4.4
    • 1.4.5
    • 1.4.6
    • 1.4.7
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.6.1
    • 1.7.0
    • 1.8.0
    • 1.8.1
    • 1.9.0
    • 1.9.1
    • 1.9.2
    • 1.9.3
    • 1.9.4
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.1.0
    • 2.2.0
    Affected ranges
    • ECOSYSTEM: < 2.2.1

    Update to 2.2.1

Original sources

Check your server →