Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Antchfx
  • Xpath

No data.

No data.

References
Link Providers
https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494 cve-icon cve-icon cve-icon
https://github.com/antchfx/xpath/issues/121 cve-icon cve-icon cve-icon
https://github.com/golang/vulndb/issues/4526 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-32287 cve-icon
https://pkg.go.dev/vuln/GO-2026-4526 cve-icon cve-icon cve-icon
https://securityinfinity.com/research/infinite-loop-dos-in-antchfx-xpath-logicalquery-select cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-32287 cve-icon
History

Tue, 31 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770

Mon, 30 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Mon, 30 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-606
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 29 Mar 2026 20:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770

Fri, 27 Mar 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
CWE-770

Fri, 27 Mar 2026 09:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
CWE-770

Fri, 27 Mar 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Antchfx
Antchfx xpath
Vendors & Products Antchfx
Antchfx xpath

Thu, 26 Mar 2026 20:00:00 +0000

Type Values Removed Values Added
Description Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".
Title Infinite loop in github.com/antchfx/xpath
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published: 2026-03-26T19:40:52.142Z

Updated: 2026-03-30T14:55:05.920Z

Reserved: 2026-03-11T16:38:46.556Z

Link: CVE-2026-32287

cve-icon Vulnrichment

Updated: 2026-03-30T14:12:56.371Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-26T20:16:12.403

Modified: 2026-03-30T15:16:28.290

Link: CVE-2026-32287

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-03-26T19:40:52Z

Links: CVE-2026-32287 - Bugzilla