Vulnerability Description
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {% case %} tag without an associated {% when %} or {% else %} block and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give the EOF token matching kind and value fields, allowing malicious template authors to craft templates for a denial of service attack. This issue is fixed in version 2.2.1.
Related Weaknesses (CWE)
References
- https://github.com/jg-rp/liquid/commit/26db8931cf35e8433c1ca506fc32c3bb62f743d4
- https://github.com/jg-rp/liquid/releases/tag/v2.2.1
- https://github.com/jg-rp/liquid/security/advisories/GHSA-vq2f-vcc9-j8mv
FAQ
What is CVE-2026-55865?
CVE-2026-55865 is a documented vulnerability. Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {% case %} tag without an associated {% when %} or {% else %} block and no terminating {% endcase %...
How severe is CVE-2026-55865?
CVSS scoring is not yet available for CVE-2026-55865. Check NVD for updates.
Is there a patch for CVE-2026-55865?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.