CVE-2026-32287 PUBLISHED

Infinite loop in github.com/antchfx/xpath

Assigner: Go
Reserved: 11.03.2026 Published: 26.03.2026 Updated: 26.03.2026

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

Product Status

Vendor github.com/antchfx/xpath
Product github.com/antchfx/xpath
Versions Default: unaffected
  • affected from 0 to 1.3.6 (excl.)

References

Problem Types

  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')