CVE-2026-32287: 
Terraform Community vulnerability analysis and mitigation

CVE-2026-32287 is a denial-of-service vulnerability in the github.com/antchfx/xpath Go library caused by an infinite loop triggered by boolean XPath expressions that evaluate to true. Discovered and reported by researcher athuljayaram on February 19, 2026, it was published to the NVD on March 26, 2026, and to the GitHub Advisory Database on March 29, 2026. All versions of antchfx/xpath prior to 1.3.6 are affected, as are downstream packages antchfx/xmlquery (≤v1.5.0), antchfx/htmlquery (≤v1.3.5), and antchfx/jsonquery (≤v1.3.6). IBM Business Automation Insights is also listed as an affected product. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GitHub Issue).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition) and CWE-400 (Uncontrolled Resource Consumption). In query.go, the logicalQuery.Select() function lacks a termination guard: when a boolean XPath expression evaluates to true, it returns t.Current().Copy() on every invocation and never returns nil. The calling MoveNext() loop in NodeIterator only terminates when Select() returns nil, so it loops indefinitely, pegging one CPU core at 100%. Triggering expressions include trivially true comparisons such as 1=1, 0<1, 1>0, true(), and not(false()); expressions evaluating to false return normally. Any application that passes user-controlled input to Find(), QueryAll(), or QuerySelectorAll() in the affected antchfx query packages is exploitable with no authentication required (GitHub Issue, Github Advisory).

Successful exploitation causes a complete availability denial of service: a single crafted request containing a trivially true XPath expression permanently stalls a goroutine and consumes 100% of one CPU core until the process is restarted. There is no impact on confidentiality or data integrity. Applications relying on the affected antchfx query libraries for XML, HTML, or JSON processing are rendered unresponsive, and repeated requests could exhaust all available CPU resources on multi-core systems (GitHub Issue, Github Advisory).

No confirmed in-the-wild exploitation has been observed, and no functional exploit code has been verified as publicly available; a referenced research page at securityinfinity.com was found to contain no technical exploit details (Feedly). The EPSS score is approximately 0.037% (11th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, exploitation requires no authentication, no privileges, and no user interaction, making it trivially easy to attempt against any internet-exposed application that accepts user-controlled XPath input.

1. Reconnaissance: Identify applications that accept user-supplied XPath expressions and use the antchfx/xpath library (versions < 1.3.6) or its downstream packages (antchfx/xmlquery, antchfx/htmlquery, antchfx/jsonquery).
2. Craft malicious payload: Prepare a trivially true boolean XPath expression such as 1=1, true(), 0<1, or not(false()).
3. Submit the payload: Send an HTTP request (or equivalent input) to the target application's endpoint that processes XPath queries, injecting the crafted expression as the XPath selector parameter.
4. Trigger infinite loop: The application passes the expression to Find(), QueryAll(), or QuerySelectorAll(), which internally calls logicalQuery.Select(). Because the expression evaluates to true, Select() never returns nil, causing MoveNext() to loop indefinitely.
5. Achieve denial of service: One CPU core is consumed at 100% per request. Sending multiple such requests exhausts available CPU resources, rendering the service unresponsive until the process is restarted (GitHub Issue, Github Advisory).

• Network: Repeated HTTP requests containing XPath parameters with trivially true boolean expressions (e.g., 1=1, true(), 0<1, not(false())) in query fields or API parameters.
• Process/System: Sustained 100% CPU utilization on one or more cores by the Go application process; goroutine count growing without bound as observed via pprof or runtime metrics.
• Logs: Application logs showing requests with XPath expressions that never complete or time out; absence of response logs for requests containing boolean XPath selectors.
• Runtime Metrics: Go runtime goroutine leak indicators — goroutines stuck in MoveNext() or QuerySelectorAll() call stacks as visible in /debug/pprof/goroutine output.

The primary remediation is to upgrade github.com/antchfx/xpath to version 1.3.6 or later, which removes the faulty logicalQuery.Select() implementation via commit afd4762 (Patch Commit). Downstream packages antchfx/xmlquery, antchfx/htmlquery, and antchfx/jsonquery should also be updated to versions that depend on the patched xpath library. IBM Business Automation Insights users should apply the May 2026 iFixes (IBM Advisory). As a workaround where patching is not immediately possible, implement input validation to reject or sanitize XPath expressions before passing them to the library, and add request timeouts or goroutine-level context cancellation to limit the impact of runaway queries.

The vulnerability was tracked by the Go vulnerability database team via golang/vulndb issue #4526 and assigned the identifier GO-2026-4526, reflecting standard Go ecosystem vulnerability handling (Go VulnDB). The issue was also picked up by OpenSUSE security announcements, Red Hat (RHSA-2026:9388), Amazon Linux security advisories, and Microsoft's MSRC update guide, indicating broad downstream impact across Linux distributions and enterprise software. No significant social media controversy or researcher debate was noted beyond the original disclosure.