VULNERABILITY INTELLIGENCE

CVE-2026-55865

EPSS probability0.45%
CISA KEVNot currently listed
Published2026-07-09
Last modified2026-10-25

Description

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {% case %} tag without an associated {% when %} or {% else %} block and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give the EOF token matching kind and value fields, allowing malicious template authors to craft templates for a denial of service attack. This issue is fixed in version 2.2.1.

Weakness classification

  • security-advisories@github.com: CWE-835

Primary references