Описание
Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| golang-github-antchfx-xpath | fixed | 1.3.6-1 | package | |
| golang-github-antchfx-xpath | no-dsa | trixie | package | |
| golang-github-antchfx-xpath | no-dsa | bookworm | package | |
| golang-github-antchfx-xpath | postponed | bullseye | package |
Примечания
https://github.com/antchfx/xpath/issues/121
Fixed by: https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494 (v1.3.6)
EPSS
Связанные уязвимости
Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".
Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".
Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".
XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion
EPSS