Python Liquid is a Python engine for the Liquid template language. Prior to version 2.2.1, a malformed `{% case %}` tag that omits an associated `{% when %}` or `{% else %}` block and lacks a terminating `{% endcase %}` tag causes the parser to enter an infinite loop at parse time. This occurs because `liquid.TokenStream.eof` does not return an EOF token with the matching kind and value fields, allowing a malicious template author to craft a template that leads to a denial‑of‑service condition. The issue is fixed in version 2.2.1.

The vulnerability affects the jg-rp:liquid product, commonly known as Python Liquid. All releases prior to version 2.2.1 are impacted; upgrading to 2.2.1 or later resolves the issue.

The CVSS score of 7.1 indicates high severity, and the EPSS score of < 1% shows a very low but non‑zero chance of exploitation. The flaw is not KEV catalog. The most likely attack vector involves an adversary supplying a crafted template containing a malformed `{% case %}` block to a vulnerable application that uses Python Liquid for rendering. Successful exploitation would cause the parser to enter an infinite loop, effectively blocking the process handling the template and leading to a denial of service.