CVE-2026-32287

Description

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

PUBLISHED Reserved 2026-03-11 | Published 2026-03-26 | Updated 2026-03-30 | Assigner Go

Problem types

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

Product status

References

securityinfinity.com/...in-antchfx-xpath-logicalquery-select exploit

github.com/antchfx/xpath/issues/121

github.com/...ommit/afd4762cc342af56345a3fb4002a59281fcab494

github.com/golang/vulndb/issues/4526

pkg.go.dev/vuln/GO-2026-4526

cve.org (CVE-2026-32287)

nvd.nist.gov (CVE-2026-32287)

Download JSON