PYSEC-2026-3035
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/python-liquid/PYSEC-2026-3035.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3035
- Aliases
- Published
- 2026-07-13T15:46:21Z
- Modified
- 2026-07-13T16:33:29Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
- Details
-
Impact
Given a malformed
{% case %}tag without associated{% when %}or{% else %}block, and no terminating{% endcase %}tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack.Patches
The issue is fixed in version 2.2.1 with the correction of the
liquid.TokenStream.eofattribute. Thekindandvalueof the special EOF token are now the same, so either can be tested againstliquid.token.TOKEN_EOF.Workarounds
Manually correct the definition of
liquid.TokenStream.eofbefore parsing any templates.import liquid from liquid.token import TOKEN_EOF liquid.stream.TokenStream.eof = liquid.Token(TOKEN_EOF, TOKEN_EOF, -1, "") # ... - References
Affected packages
PyPI / python-liquid
Package
- Name
- python-liquid
- View open source insights on deps.dev
- Purl
- pkg:pypi/python-liquid
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.2.1
Affected versions
0.*
0.5.1
0.5.2
0.5.3
0.5.5
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.8.1
0.9.0
0.10.0
0.10.1
0.11.0
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.10.0
1.10.2
1.11.0
1.12.0
1.12.1
1.12.2
1.13.0
2.*
2.0.0
2.0.1
2.0.2
2.1.0
2.2.0