Fluid Attacks Database

Description

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
rpm rhel10	opentelemetry-collector	-	-
rpm rhel9	opentelemetry-collector	-	-
debian 13	golang-github-antchfx-xpath	=1.3.3-1 \|\| =1.3.5-1 \|\| =1.3.6-1	-
go	github.com/antchfx/xpath	>=0 <1.3.6	1.3.6
debian 14	golang-github-antchfx-xpath	=1.3.3-1 \|\| =1.3.5-1 \|\| >=0 <1.3.6-1	1.3.6-1
debian 12	golang-github-antchfx-xpath	=1.1.2-2 \|\| =1.3.0-1 \|\| =1.3.1-1 \|\| =1.3.2-1 \|\| =1.3.3-1 \|\| =1.3.5-1 \|\| =1.3.6-1	-
debian 11	golang-github-antchfx-xpath	=1.1.2-2 \|\| =1.3.0-1 \|\| =1.3.1-1 \|\| =1.3.2-1 \|\| =1.3.3-1 \|\| =1.3.5-1 \|\| =1.3.6-1	-

Aliases

1. CVE-2026-322872. NVD-2026-322873. OSV-2026-322874. OSV-DEBIAN-2026-322875. GCVE-2026-322876. SECURITY-TRACKER-CVE-2026-32287

References

1. https://github.com/antchfx/xpath/issues/1212. https://github.com/golang/vulndb/issues/45263. https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab4944. https://pkg.go.dev/vuln/GO-2026-45265. https://securityinfinity.com/research/infinite-loop-dos-in-antchfx-xpath-logicalquery-select

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.