CVE-2026-4645 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the `github.com/antchfx/xpath` component. A remote attacker could exploit this vulnerability by submitting crafted Boolean XPath expressions that evaluate to true. This can cause an infinite loop in the `logicalQuery.Select` function, leading to 100% CPU utilization and a Denial of Service (DoS) condition for the affected system.

EPSS 0.12% · 30.2th percentile

Risk Scores

CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.12%
30.2th percentile

Affected Products

VendorProductVersions
Red HatRed Hat OpenShift distributed tracing 3
Red HatFile Integrity Operator
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift distributed tracing 3
Red HatRed Hat Enterprise Linux 10
Red HatMigration Toolkit for Applications 8
Red HatFile Integrity Operator
Red HatRed Hat Enterprise Linux 9
Red HatRed Hat OpenShift Container Platform 4
Red HatFile Integrity Operator
Red HatMigration Toolkit for Applications 8
Red HatMigration Toolkit for Applications 8
Red HatCompliance Operator
Red HatFile Integrity Operator
Red HatMigration Toolkit for Applications 8
Red HatMigration Toolkit for Applications 8
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat OpenShift distributed tracing 3
Red HatMigration Toolkit for Applications 8
Red HatRed Hat OpenShift Container Platform 4

…and 2 more

Timeline

References

…and 62 more

Open in Interactive Console →