---
id: CVE-2026-55865
aliases:
  - GHSA-vq2f-vcc9-j8mv
  - PYSEC-2026-3035
title: 'Python Liquid: Infinite loop when parsing malformed `{% case %}` tags'
summary: 'Python Liquid: Infinite loop when parsing malformed `{% case %}` tags'
severity: medium
vendor: python-liquid
product: python-liquid
ecosystem: pip
affected:
  - python-liquid < 2.2.1
patched:
  - python-liquid 2.2.1
published: '2026-06-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:09.596917909Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vq2f-vcc9-j8mv'
references:
  - url: 'https://github.com/jg-rp/liquid/security/advisories/GHSA-vq2f-vcc9-j8mv'
  - url: 'https://github.com/jg-rp/liquid'
  - url: 'https://github.com/advisories/GHSA-vq2f-vcc9-j8mv'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00451
epssPercentile: 0.36454
cwe:
  - CWE-835
ingestedAt: '2026-06-22T13:35:24.446Z'
---

## Overview

### Impact
Given a malformed `{% case %}` tag without associated `{% when %}` or `{% else %}` block, and no terminating `{% endcase %}` tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack.

### Patches
The issue is fixed in version 2.2.1 with the correction of the `liquid.TokenStream.eof` attribute. The `kind` and `value` of the special EOF token are now the same, so either can be tested against `liquid.token.TOKEN_EOF`.

### Workarounds
Manually correct the definition of `liquid.TokenStream.eof` before parsing any templates.

```python
import liquid
from liquid.token import TOKEN_EOF

liquid.stream.TokenStream.eof = liquid.Token(TOKEN_EOF, TOKEN_EOF, -1, "")

# ...
```

## Affected packages

- `python-liquid < 2.2.1`

## Remediation

Upgrade to a patched release:

- `python-liquid 2.2.1`