Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {% case %} tag without an associated {% when %} or {% else %} block and no terminating {% endcase %} tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give the EOF token matching kind and value fields, allowing malicious template authors to craft templates for a denial of service attack. This issue is fixed in version 2.2.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed {%
    case %} tag without an associated {% when %} or {% else %} block and no terminating {% endcase %} tag,
    Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give the EOF
    token matching kind and value fields, allowing malicious template authors to craft templates for a denial
    of service attack. This issue is fixed in version 2.2.1. (CVE-2026-55865)

ID	Name	Product	Family	Type	Severity
463413	Echo: python-liquid: security update to 2.2.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
463413	Echo: python-liquid: security update to 2.2.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
443644	SCA: security update for python-liquid (GHSA-vq2f-vcc9-j8mv)	Tenable Cloud Security	SCA Checks	Local	high
443644	SCA: security update for python-liquid (GHSA-vq2f-vcc9-j8mv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-55865

high

Tenable Plugins

high

high

high

high