XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion

HIGH 7.5CVE-2026-32287 · GHSA-65xw-vw82-r86x · GO-2026-4526 · Published 26/03/2026 · updated 17/06/2026

In short

CVE-2026-32287 is a HIGH (CVSS 7.5) vulnerability affecting github.com/antchfx/xpath, xpath (antchfx).
Chance of exploitation in the next 30 days (EPSS): 0.54%, higher than 45.5% of all vulnerabilities.
Fix: update to 1.3.6 or later.

Package	Affected versions	Patched versions
github.com/antchfx/xpath Go	`< 1.3.6`	`1.3.6`
xpath antchfx	`< 1.3.6`	`1.3.6`

Description

Boolean expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

NVD description

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

References

nvd.nist.gov/vuln/detail/CVE-2026-32287 · ADVISORY
antchfx/xpath · WEB
golang/vulndb · WEB
antchfx/xpath commit afd4762 · WEB
antchfx/xpath · PACKAGE
pkg.go.dev/vuln/GO-2026-4526 · WEB
securityinfinity.com/research/infinite-loop-dos-in-antchfx-xpath-logicalquery-select · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free