antchfx vulnerabilities

Products

• github.com/antchfx/xmlquery 1
• github.com/antchfx/xpath 1

Latest antchfx CVEs

Newest publication first

1. CVE-2026-32287 Infinite loop in github.com/antchfx/xpath

   Published 2026-03-26

   High·CVSS 7.5 EPSS 0.55%

   Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

2. CVE-2020-25614 xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service

   Published 2020-09-16

   Critical·CVSS 9.8 EPSS 1.9%

   xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.