Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

ImpactGiven a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. PatchesThe issue is fixed in...

PYSEC-2026-3035 Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Impact Given a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in...

pharia-inference-sdk (0.1.0), solace-agent-mesh (>=1.8.0, <=1.28.4) potentially affected by CVE-2026-55865 via python-liquid (>=2.0.2, <=2.2.0)

python-liquid PYPI version =2.0.2, =1.8.0, =1.28.4 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

plainqafact (>=0.4.0, <=1.1.0), python-fhir-converter (0.0.21) potentially affected by CVE-2026-55865 via python-liquid (1.10.2)

python-liquid PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - plainqafact =0.4.0, =1.1.0 - python-fhir-converter 0.0.21 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

pharia-data-sdk (>=0.1.1, <=0.1.6), pharia-inference-sdk (>=0.1.2, <=0.1.6) +1 more potentially affected by CVE-2026-55865 via python-liquid (1.9.4)

python-liquid PYPI version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - pharia-data-sdk =0.1.1, =0.1.2, =0.1.0, =0.1.7 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

python-fhir-converter (0.0.22) potentially affected by CVE-2026-55865 via python-liquid (1.11.0)

python-liquid PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - python-fhir-converter 0.0.22 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +2 more potentially affected by CVE-2026-55865 via python-liquid (1.13.0)

python-liquid PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - blrec =1.8.0a3, =0.26.6rc0, =0.8.0, =0.0.1, =0.0.20 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

python-fhir-converter (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-55865 via python-liquid (1.12.1)

python-liquid PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - python-fhir-converter =0.1.0, =0.3.0 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

PT-2026-59657

Impact Given a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in...

CVE-2026-55865

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

CVE-2026-55865 Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

CVE-2026-55865 Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

CVE-2026-55865

CVE-2026-55865 concerns the Python Liquid template engine. Before version 2.2.1, a malformed {% case %} tag without a corresponding {% when %} or {% else %} and without a terminating {% endcase %} could cause an infinite loop during parsing, due to an incorrect EOF token handling in liquid.TokenS...

CVE-2026-55865

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

EUVD-2026-42693

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

CVE-2026-55865 Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +7 more potentially affected by CVE-2026-55865 via python-liquid (>=1.9.4, <=2.2.0)

python-liquid PYPI version =1.9.4, =1.8.0a3, =0.26.6rc0, =0.8.0, =0.1.1, =0.1.0, =0.1.0, =0.4.0, =0.0.1, =1.8.0, =1.28.4 Source cves: CVE-2026-55865 Source advisory: MEND:CVE-2026-55865...

CVE-2026-55865: Loop with Unreachable Exit Condition

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

GHSA-VQ2F-VCC9-J8MV Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Impact Given a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in...

Infinite loop

Overview python-liquid is an A Python engine for the Liquid template language. Affected versions of this package are vulnerable to Infinite loop in the % case % tag parsing logic, caused by an incorrect definition of the EOF token's kind and value in the TokenStream.eof attribute. A user who can...