CVE-2026-4645: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-4645 is a Denial of Service vulnerability in the github.com/antchfx/xpath Go library (CWE-835: Loop with Unreachable Exit Condition) that allows remote attackers to trigger an infinite loop by submitting crafted Boolean XPath expressions that evaluate to true. It was reported on February 19, 2026, published to NVD on March 23, 2026, and subsequently determined to be a duplicate of CVE-2026-32287 (status: Rejected). Affected Microsoft products include cbl2_terraform_1.3.2-29, cbl2_telegraf_1.29.4-21, azl3_telegraf_1.31.0-15, and azl3_telegraf_1.31.0-17, as well as any application depending on github.com/antchfx/xpath v1.3.5 and earlier. The CVSS v3.1 base score is 7.5 (High) (Red Hat Bugzilla, GitHub Issue #121, MSRC Advisory).

The root cause is a missing termination guard in the logicalQuery.Select() function in query.go of github.com/antchfx/xpath (CWE-835). When a Boolean XPath expression evaluates to true (e.g., 1=1, true(), 0<1, not(false())), Select() returns t.Current().Copy() on every invocation and never returns nil; the caller's MoveNext() loop only terminates on a nil return, so the goroutine spins indefinitely at 100% CPU. Any application that passes user-controlled input to Find(), QueryAll(), or QuerySelectorAll() in the downstream packages antchfx/xmlquery, antchfx/htmlquery, or antchfx/jsonquery inherits this vulnerability. The fix (commit afd4762) removes the offending code block from logicalQuery.Select() so it unconditionally returns nil, preventing the infinite loop (GitHub Issue #121, Fix Commit, Go VulnDB Issue).

Successful exploitation causes complete CPU exhaustion on the affected system — a single request containing a trivial expression such as 1=1 permanently consumes one CPU core and stalls the processing goroutine until the process is restarted, resulting in a Denial of Service condition. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Downstream packages (antchfx/xmlquery v1.5.0, antchfx/htmlquery v1.3.5, antchfx/jsonquery v1.3.6) and Microsoft products packaging these libraries (Telegraf, Terraform builds) are all affected (GitHub Issue #121, Go VulnDB Issue).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (MSRC Advisory). The vulnerability requires no authentication, no user interaction, and is reachable over the network, making it trivially exploitable by any remote attacker who can submit XPath expressions to a vulnerable application. The EPSS score is approximately 0.0015 (0.15%), indicating low current exploitation probability. The CVE has been rejected as a duplicate of CVE-2026-32287 and is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify applications that accept user-controlled XPath expressions and use github.com/antchfx/xpath (or downstream packages antchfx/xmlquery, antchfx/htmlquery, antchfx/jsonquery) — this includes services built on affected Microsoft Telegraf or Terraform packages.
2. Craft payload: Construct a Boolean XPath expression that always evaluates to true, such as 1=1, true(), 0<1, 1>0, 0<=1, 1!=2, or not(false()).
3. Submit payload: Send the crafted XPath expression as input to any endpoint that passes it to Find(), QueryAll(), or QuerySelectorAll() — for example, via an HTTP request parameter, API field, or configuration input that accepts XPath queries.
4. Trigger infinite loop: The logicalQuery.Select() function enters an infinite loop, permanently consuming one CPU core at 100% and stalling the goroutine, causing the service to become unresponsive.
5. Sustain DoS: Repeat with additional requests or connections to exhaust remaining CPU resources, maintaining the denial-of-service condition until the process is restarted (GitHub Issue #121, Go VulnDB Issue).

• Process: Sustained 100% CPU utilization on one or more cores by the affected Go application process (e.g., telegraf, terraform, or custom services using antchfx/xpath).
• Logs: Application logs showing requests containing XPath expressions such as 1=1, true(), 0<1, 1>0, not(false()), or similar Boolean tautologies submitted to XPath-processing endpoints.
• Network: Repeated or sustained HTTP requests to endpoints that accept XPath query parameters, particularly from a single source IP, with minimal response or timeout behavior from the server.
• Application behavior: Service unresponsiveness or goroutine stalls observable via Go runtime profiling (e.g., pprof showing goroutines blocked in logicalQuery.Select or MoveNext) (GitHub Issue #121).

The fix is available in commit afd4762 of the antchfx/xpath repository, which removes the infinite-loop-inducing code block from logicalQuery.Select(). Microsoft released patches for affected products on March 27, 2026; users should update to fixed versions of cbl2_telegraf, azl3_telegraf, and cbl2_terraform as listed in the MSRC advisory. As a workaround, implement input validation to reject or sanitize XPath expressions before passing them to the library, and apply network-level controls to restrict XPath query submissions from untrusted sources. Monitor for unusual CPU utilization as an indicator of exploitation attempts (MSRC Advisory, Fix Commit, GitHub Advisory).

Red Hat triaged the vulnerability and confirmed it as a duplicate of CVE-2026-32287 on March 30, 2026, leading to the CVE's rejection status (Red Hat Bugzilla). The original issue was reported by researcher athuljayaramop on the antchfx/xpath GitHub repository with a detailed root cause analysis and suggested fix, and was also tracked in the Go vulnerability database (GitHub Issue #121, Go VulnDB Issue). Red Hat issued errata RHSA-2026:9385 addressing the underlying issue in affected packages (Red Hat Errata).