GO-2026-4526

Infinite loop in github.com/antchfx/xpath

En bref

Publiée: 2026-03-17 20:58 UTC
Mise à jour: 2026-03-30 14:29 UTC
CVE: CVE-2026-32287
Alias: GHSA-65xw-vw82-r86x

Description

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

Paquets affectés

Paquet	Versions
Go · github.com/antchfx/xpath	introduced 0, fixed 1.3.6

Références

https://github.com/antchfx/xpath/issues/121 REPORT
https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494 FIX
https://github.com/golang/vulndb/issues/4526 REPORT

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database