> CVE-2026-32287

« BACK_TO_HOME
PUBLISHED
2026-03-26 20:16
MODIFIED
2026-03-26 20:16
EPSS (Prob. Exploit)
0.54%
Top 54.4%
DATA SOURCES:
NVD 🔗 2026-03-26 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-05 OSV 🔗 2026-11-01 MSRC 🔗 2026-11-02

> DESCRIPTION

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.2 release
Red Hat build of OpenTelemetry 3.9.2 has been released

> GITHUB SECURITY ADVISORY

GHSA-65xw-vw82-r86x HIGH

XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion

AFFECTED PACKAGES:
GO / github.com/antchfx/xpath
< 1.3.6
Fixed in: 1.3.6

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Infinite loop in github.com/antchfx/xpath

AFFECTED PACKAGES:
Unknown / Unknown
26 versions affected
ALIASES:
GHSA-65xw-vw82-r86x, GO-2026-4526

> HISTORIQUE DES MODIFICATIONS

Première apparition
26/03/2026 20:16
Source: NVD
Total des modifications: 0 Dernière mise à jour: 7 months ago

> REFERENCES

https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494
https://github.com/antchfx/xpath/issues/121
https://github.com/golang/vulndb/issues/4526
https://pkg.go.dev/vuln/GO-2026-4526
« BACK_TO_HOME