XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion

ÉLEVÉE 7.5CVE-2026-32287 · GHSA-65xw-vw82-r86x · GO-2026-4526 · Published 26/03/2026 · updated 17/06/2026

En bref

CVE-2026-32287 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant github.com/antchfx/xpath, xpath (antchfx).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.54%, plus élevée que 45.5% des vulnérabilités.
Correctif : mettre à jour vers 1.3.6 ou plus récent.

Package	Affected versions	Patched versions
github.com/antchfx/xpath Go	`< 1.3.6`	`1.3.6`
xpath antchfx	`< 1.3.6`	`1.3.6`

Description

Boolean expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

NVD description

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

References

nvd.nist.gov/vuln/detail/CVE-2026-32287 · ADVISORY
antchfx/xpath · WEB
golang/vulndb · WEB
antchfx/xpath commit afd4762 · WEB
antchfx/xpath · PACKAGE
pkg.go.dev/vuln/GO-2026-4526 · WEB
securityinfinity.com/research/infinite-loop-dos-in-antchfx-xpath-logicalquery-select · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free