VAITP Dataset

← Back to the dataset

CVE-2026-55865

A malformed case tag in Python Liquid causes an infinite loop DoS.

  • CVSS 7.1
  • CWE-835
  • Resource Management
  • Remote

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {% case %} tag without an associated {% when %} or {% else %} block and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give the EOF token matching kind and value fields, allowing malicious template authors to craft templates for a denial of service attack. This issue is fixed in version 2.2.1.

CVSS base score
7.1
Published
2026-07-09
OWASP
A08 Software and Data Integrity Failures
Orthogonal defect classification
Checking
Code defect classification
Incorrect Check
Category
Resource Management
Subcategory
Insecure Parsing or Deserialization
Accessibility scope
Remote
Impact
Denial of Service (DoS)
Affected component
Python Liqui
Fixed by upgrading
Yes

Solution

Upgrade Python Liquid to version 2.2.1 or later.

Vulnerable code sample

import liquid

# This example requires python-liquid version < 2.2.1 to be installed.
# For example: pip install python-liquid==2.2.0

# The malformed template contains a 'case' tag without a closing 'endcase' tag.
malformed_template_string = "{% case some_variable %}"

print("Attempting to parse a malformed template with a vulnerable version...")

# In vulnerable versions of python-liquid, the following line will cause
# the program to enter an infinite loop at parse time, consuming 100% of a CPU core.
# This demonstrates the Denial of Service (DoS) vulnerability.
template = liquid.Template(malformed_template_string)

# The program will never reach this line.
print("Parsing complete.")

Patched code sample

# The following conceptual code demonstrates the logic used to fix the vulnerability.
# The original code would loop indefinitely if an 'endcase' tag was missing.
# The fix involves explicitly checking for the end of the token stream inside
# the parsing loop, raising an error instead of hanging.

# Assume the existence of:
# - A `stream` object that provides `current` and `peek` tokens.
# - A `TOKEN_EOF` constant representing the end-of-file token type.
# - A `TemplateSyntaxError` exception class.

# In the context of a tag parsing function:
while not stream.current.istag("endcase"):
    if stream.current.istag("when") or stream.current.istag("else"):
        # Logic to handle 'when' and 'else' blocks would be here.
        stream.next()
        continue

    # THE FIX:
    # Check if the next token is the end of the stream. If so, it means
    # the 'case' block is unclosed, so we must raise an error to prevent
    # an infinite loop.
    if stream.peek.type == TOKEN_EOF:
        raise TemplateSyntaxError(
            f"expected 'endcase', but found {stream.current.value!r}",
            linenum=stream.current.linenum,
        )

    # In the real fix, this part raises an error for any other unexpected token.
    # For simplicity, we just advance the stream.
    stream.next()

Payload

{% case x %}

Cite this entry

@misc{vaitp:cve202655865,
  title        = {{A malformed case tag in Python Liquid causes an infinite loop DoS.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-55865},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-55865/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::