Python Liquid is a Python engine for the Liquid template language. Prior to version 2.2.1, when a template contains a malformed `{% case %}` tag that omits an associated `{% when %}` or `{% else %}` block and does not close with a `{% endcase %}` tag, the parser enters an infinite loop during parsing. This occurs because the token stream reader fails to produce an EOF token with the matching kind and value fields, allowing a malicious template author to create a denial‑of‑service template. The vulnerability is fixed in release 2.2.1.

The vulnerability affects the jg-rp:liquid product, commonly known as Python Liquid. All releases prior to version 2.2.1 are impacted; upgrading to 2.2.1 or later resolves the issue.

The CVSS score of 7.1 indicates high severity, and the EPSS score of < 1% shows a very low but non‑zero chance of exploitation. The flaw is not included in the CISA KEV catalog. The most likely attack vector involves an adversary supplying a crafted template containing a malformed `{% case %}` block to a vulnerable application that uses Python Liquid for rendering. Successful exploitation would cause the parser to enter an infinite loop, effectively blocking the process handling the template and leading to a denial of service.