CVE-2026-32287

Katalog CVE

CVSS 7.5 · High EPSS 0,70%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada antchfx xpath. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494 patch
• https://github.com/antchfx/xpath/issues/121 issue tracking · advisory pihak ketiga
• https://github.com/golang/vulndb/issues/4526 issue tracking · advisory pihak ketiga
• https://pkg.go.dev/vuln/GO-2026-4526 advisory pihak ketiga
• https://securityinfinity.com/research/infinite-loop-dos-in-antchfx-xpath-logicalquery-select exploit · advisory pihak ketiga