CVE-2026-55865Medium▾ SunlitPython Liquid: Infinite loop when parsing malformed `{% case %}` tags
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.5%
Last analysed / modified upstream
Given a malformed {% case %} tag without associated {% when %} or {% else %} block, and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack.
The issue is fixed in version 2.2.1 with the correction of the liquid.TokenStream.eof attribute. The kind and value of the special EOF token are now the same, so either can be tested against liquid.token.TOKEN_EOF.
Manually correct the definition of liquid.TokenStream.eof before parsing any templates.
import liquid
from liquid.token import TOKEN_EOF
liquid.stream.TokenStream.eof = liquid.Token(TOKEN_EOF, TOKEN_EOF, -1, "")
# ...
python-liquid < 2.2.1Upgrade to a patched release:
python-liquid 2.2.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45017High· 7.5python-liquid: Absolute paths escape filesystem loader search path
CVE-2026-62949Medium· 6.5AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework
CVE-2026-43871High· 7.5thrift: Apache Thrift: Denial of Service via infinite loop (CVE-2026-43871)
CVE-2026-84309Mediumpypdf is a free and open-source pure-python PDF library
CVE-2026-4111High· 7.5A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path
CVE-2026-54623High· 7.1django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django