Skip to content
Fencer Intel
high 7.5

CVE-2026-32287 json

Infinite loop in github.com/antchfx/xpath

published 7mo ago modified last mo. also GHSA-65xw-vw82-r86x , GO-2026-4526 , EUVD-2026-16349

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

Patch / fix

  • go github.com/antchfx/xpath 1.3.6
  • github.com/antchfx/xpath github.com/antchfx/xpath 1.3.6
  • golang-github-antchfx-xpath Debian 14 1.3.6-1

debian advisories DEBIAN-CVE-2026-32287

  • govulncheck-vulndb openSUSE Leap 15.6 0.0.20260326T203309-150000.1.155.2

suse advisories SUSE-SU-2026:1135-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

  • telegraf Azure Linux 3.0 1.31.0-16

azure linux advisories AZL-81639

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-32287 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-32287 updated cvss 6.2

github.com/antchfx/xpath: github.com/antchfx/xpath: Denial of Service due to infinite loop via boolean XPath expressions

  • Red Hat Compliance Operator compliance/openshift-compliance-rhel8-operator, compliance/openshift-compliance-operator-bundle Red Hat File Integrity Operator compliance/openshift-compliance-openscap-rhel8, compliance/openshift-compliance-rhel8-operator, compliance/openshift-compliance-operator-bundle, compliance/openshift-compliance-must-gather-rhel8 Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, mta/mta-solution-server-rhel9, mta/mta-java-external-provider-rhel9, mta/mta-dotnet-external-provider-rhel8, mta/mta-dotnet-external-provider-rhel9, mta/mta-generic-external-provider-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9 Red Hat Enterprise Linux 9 opentelemetry-collector Red Hat Enterprise Linux 10 opentelemetry-collector
    +2 more products
    Red Hat OpenShift Container Platform 4 compliance/openshift-compliance-openscap-rhel8, compliance/openshift-compliance-rhel8-operator, compliance/openshift-compliance-must-gather-rhel8 Red Hat OpenShift distributed tracing 3 rhosdt/tempo-rhel9, rhosdt/tempo-query-rhel9, rhosdt/tempo-jaeger-query-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift distributed tracing 3.9.3 rhosdt 1776185379
    fixed: vendor fix RHSA-2026:9388
  • Red Hat Hardened Images golang1.25, golang1.26
    not affected: component not present
  • Red Hat OpenShift distributed tracing 3.9.3 rhosdt 1776185328, rhosdt 1776185352, rhosdt 1776245088
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
7mo ago

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • securityinfinity.com https://securityinfinity.com/research/infinite-loop-dos-in-antchfx-xpath-logicalquery-select referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/antchfx/xpath
<1.3.6
1.3.6

Affected products

  • github.com/antchfx/xpath github.com/antchfx/xpath

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.