Is there a patch available for CVE-2026-55865?

Yes, a patch is available for CVE-2026-55865. Update the affected software to the latest version immediately.

Python CVE-2026-55865

Q: What is the CVSS score of CVE-2026-55865?

CVE-2026-55865 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-42693 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-06-19 https://github.com/jg-rp/liquid

GHSA-vq2f-vcc9-j8mv

Denial Of Service Python

7.1

CVSS 4.0 · Vendor: https://github.com/jg-rp/liquid

Severity by source

Vendor (https://github.com/jg-rp/liquid) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Attacker must be able to submit a template (PR:L) to a network-reachable parser with a trivial payload (AC:L); impact is availability-only (A:H, C:N/I:N) with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/jg-rp/liquid).

CVSS VectorVendor: https://github.com/jg-rp/liquid

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 09, 2026 - 21:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 09, 2026 - 21:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 09, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jul 09, 2026 - 21:22 NVD

7.1 (HIGH)

Source Code Evidence Fetched

Jun 19, 2026 - 21:47 vuln.today

Analysis Generated

Jun 19, 2026 - 21:47 vuln.today

CVE Published

Jun 19, 2026 - 20:46 cve.org

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on python-liquid (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.2.1.

DescriptionCVE.org

Impact

Given a malformed {% case %} tag without associated {% when %} or {% else %} block, and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack.

Patches

The issue is fixed in version 2.2.1 with the correction of the liquid.TokenStream.eof attribute. The kind and value of the special EOF token are now the same, so either can be tested against liquid.token.TOKEN_EOF.

Workarounds

Manually correct the definition of liquid.TokenStream.eof before parsing any templates.

python

import liquid
from liquid.token import TOKEN_EOF

liquid.stream.TokenStream.eof = liquid.Token(TOKEN_EOF, TOKEN_EOF, -1, "")
# ...

AnalysisAI

Parsing denial of service in python-liquid before version 2.2.1 allows authenticated template authors to cause an infinite loop by submitting a malformed {% case %} tag without associated {% when %}, {% else %}, or {% endcase %}. The vulnerability resides in the token stream's EOF property, leading to an unreachable exit condition (CWE-835). A publicly available fix and detailed reproduction steps exist, but no active exploitation has been reported.