Security vulnerabilities and automated fixes for xpath issues
1 post found
A high-severity denial of service vulnerability (CVE-2026-32287) was discovered in the `github.com/antchfx/xpath` Go library, where crafted boolean XPath expressions could trigger an infinite loop, consuming CPU resources indefinitely. The fix upgrades the dependency from v1.3.3 to v1.3.6 in the `go.mod` file of the affected project. This vulnerability is particularly dangerous for any Go application that parses or evaluates XPath expressions from untrusted input.