Infinite Loop Vulnerability in Antchfx XPath Product

CVE-2026-32287

What is CVE-2026-32287?

Antchfx XPath suffers from a vulnerability where certain Boolean XPath expressions can trigger an infinite loop in the logicalQuery.Select function. This flaw can cause the system to experience 100% CPU utilization, leading to performance degradation and potential denial of service. The issue arises when using top-level selectors like '1=1' or 'true()', which can manipulate execution logic, resulting in a non-terminating process.

References