CVE-2026-55865Medium▾ SunlitPython Liquid: Infinite loop when parsing malformed `{% case %}` tags
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
0.3% → 0.5%
Last analysed / modified upstream
Given a malformed {% case %} tag without associated {% when %} or {% else %} block, and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack.
The issue is fixed in version 2.2.1 with the correction of the liquid.TokenStream.eof attribute. The kind and value of the special EOF token are now the same, so either can be tested against liquid.token.TOKEN_EOF.
Manually correct the definition of liquid.TokenStream.eof before parsing any templates.
import liquid
from liquid.token import TOKEN_EOF
liquid.stream.TokenStream.eof = liquid.Token(TOKEN_EOF, TOKEN_EOF, -1, "")
# ...
python-liquid < 2.2.1Upgrade to a patched release:
python-liquid 2.2.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45017High· 7.5python-liquid: Absolute paths escape filesystem loader search path
CVE-2026-115774Medium· 4.9Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
CVE-2026-113793Medium· 6.0pypdf: Possible infinite loop when removing tree items
CVE-2026-113792Medium· 6.0pypdf: Possible infinite loop in PdfWriter.find_outline_item
CVE-2026-113794Medium· 6.0pypdf: Possible infinite loop when hitting EOF in standard xref table
CVE-2026-114095Medium· 6.5Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object