CVE-2026-55865

Name of the Vulnerable Software and Affected Versions Python Liquid versions prior to 2.2.1

Description A denial of service issue exists where the engine hangs in an infinite loop during parse time. This occurs when a malformed {% case %} tag is used without an associated {% when %} or {% else %} block and lacks a terminating {% endcase %} tag. The root cause is that liquid.TokenStream.eof failed to provide the EOF token matching the required kind and value fields.

Recommendations Update to version 2.2.1. As a temporary workaround, manually correct the definition of liquid.TokenStream.eof before parsing templates by setting it to a liquid.Token with TOKEN EOF as both the kind and value.