CVE-2026-55865: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') in jg-rp liquid
Python Liquid versions prior to 2.2.1 contain a vulnerability where a malformed {% case %} tag without an associated {% when %} or {% else %} block and missing a terminating {% endcase %} tag causes an infinite loop during template parsing. This occurs because the parser's eof token check does not correctly identify the end of the token stream, allowing malicious templates to cause a denial of service. The issue is fixed in version 2.2.1.
AI Analysis
Technical Summary
CVE-2026-55865 is a high-severity vulnerability in the jg-rp liquid Python template engine. The flaw arises from improper handling of malformed {% case %} tags lacking {% when %} or {% else %} blocks and missing the {% endcase %} terminator. The parser enters an infinite loop at parse time due to the eof token check not matching the expected kind and value fields. This can be exploited by crafted templates to cause a denial of service by hanging the application. The vulnerability is resolved in liquid version 2.2.1.
Potential Impact
An attacker who can supply or influence template content can cause the Python Liquid engine to hang indefinitely during parsing, resulting in a denial of service condition. This impacts availability of applications using affected versions of the liquid engine prior to 2.2.1.
Mitigation Recommendations
Upgrade to liquid version 2.2.1 or later, where this infinite loop parsing issue is fixed. No other mitigations are indicated. Patch status is not explicitly stated but the fix is available in version 2.2.1.
CVE-2026-55865: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') in jg-rp liquid
Description
Python Liquid versions prior to 2.2.1 contain a vulnerability where a malformed {% case %} tag without an associated {% when %} or {% else %} block and missing a terminating {% endcase %} tag causes an infinite loop during template parsing. This occurs because the parser's eof token check does not correctly identify the end of the token stream, allowing malicious templates to cause a denial of service. The issue is fixed in version 2.2.1.
CVSS v4.0
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55865 is a high-severity vulnerability in the jg-rp liquid Python template engine. The flaw arises from improper handling of malformed {% case %} tags lacking {% when %} or {% else %} blocks and missing the {% endcase %} terminator. The parser enters an infinite loop at parse time due to the eof token check not matching the expected kind and value fields. This can be exploited by crafted templates to cause a denial of service by hanging the application. The vulnerability is resolved in liquid version 2.2.1.
Potential Impact
An attacker who can supply or influence template content can cause the Python Liquid engine to hang indefinitely during parsing, resulting in a denial of service condition. This impacts availability of applications using affected versions of the liquid engine prior to 2.2.1.
Mitigation Recommendations
Upgrade to liquid version 2.2.1 or later, where this infinite loop parsing issue is fixed. No other mitigations are indicated. Patch status is not explicitly stated but the fix is available in version 2.2.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-17T16:44:40.996Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a50101f68715ace43153c8a
Added to database: 07/09/2026, 21:18:23 UTC
Last enriched: 07/09/2026, 21:32:26 UTC
Last updated: 07/09/2026, 22:25:41 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.