What’s Vulnerable › Vulnerabilities

CVE-2026-32287: Infinite loop in github.com/antchfx/xpath

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-26 · updated 2026-06-17
• Weakness: CWE-835

Description

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

Affected products

• github.com/antchfx/xpath: before 1.3.6 — fixed in 1.3.6

How to fix

Upgrade to a fixed version: github.com/antchfx/xpath 1.3.6. Check the vendor advisory for mitigations.

References

• https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494
• https://github.com/antchfx/xpath/issues/121
• https://github.com/golang/vulndb/issues/4526
• https://pkg.go.dev/vuln/GO-2026-4526
• https://securityinfinity.com/research/infinite-loop-dos-in-antchfx-xpath-logicalquery-select

Get alerted when CVE-2026-32287 or the next vulnerability affects your stack