CVE-2026-32287 Infinite loop in github.com/antchfx/xpath

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true"...

CVE-2026-32287

CVE-2026-32287 affects the Go library github.com/antchfx/xpath. Boolean XPath expressions that evaluate to true can trigger an infinite loop in logicalQuery.Select, causing 100% CPU usage. This can be triggered by top-level selectors such as 1=1 or true(). The provided connected records confirm t...