CVE-2026-32287 Infinite loop in github.com/antchfx/xpath
An attacker can cause a denial of service via infinite loop in the Go XPath library by providing specific boolean expressions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32287?
CVE-2026-32287 is a high-severity denial of service vulnerability in github.com/antchfx/xpath, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".
Weakness: CWE-835
Which versions are affected by CVE-2026-32287?
3 open source packages ship an affected version, including github.com/antchfx/xpath. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/antchfx/xpath Go | All versions | 1.3.6 |
github.com/antchfx/xpath Go | All versions | 1.3.6 |
github.com/antchfx/xpath Go | All versions | 1.3.6 |
Products include Antchfx Xpath.
How do I fix CVE-2026-32287?
Upgrade github.com/antchfx/xpath to 1.3.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32287 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32287 exists.
Sources
Also known as AZL-81306, AZL-81639, CLEANSTART-2026-EV58978, CLEANSTART-2026-LK18323, CVE-2026-4645, DEBIAN-CVE-2026-32287 and 23 more.