CVE-2026-32287
Infinite loop in github.com/antchfx/xpath
Summary
Infinite loop in github.com/antchfx/xpath
Original description
The description as published by the source.
Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-32287 golang-github-antchfx-xpath
- Ubuntu UBUNTU-CVE-2026-32287 golang-github-antchfx-xpath
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com
- report github.com
- report securityinfinity.com
- web pkg.go.dev
- web pkg.go.dev