HIGH7.5

GHSA-65xw-vw82-r86x

XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion

Quick fix

GHSA-65xw-vw82-r86x — github.com/antchfx/xpath: upgrade to the fixed version with the command below.

go get github.com/antchfx/xpath@v1.3.6

Details

Boolean expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/antchfx/xpath

Introduced in: 0Fixed in: 1.3.6

Fixgo get github.com/antchfx/xpath@v1.3.6

References

https://nvd.nist.gov/vuln/detail/CVE-2026-32287[ADVISORY]
https://github.com/antchfx/xpath/issues/121[WEB]
https://github.com/golang/vulndb/issues/4526[WEB]
https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494[WEB]
https://github.com/antchfx/xpath[PACKAGE]
https://pkg.go.dev/vuln/GO-2026-4526[WEB]
https://securityinfinity.com/research/infinite-loop-dos-in-antchfx-xpath-logicalquery-select[WEB]