Attack Chain

1. An attacker crafts a malicious XPath expression containing a boolean expression that always evaluates to true, such as “1=1” or “true()”.
2. The attacker sends this malicious XPath expression to an application that uses the vulnerable antchfx/xpath package.
3. The application parses the XPath expression using the logicalQuery.Select function.
4. Due to the nature of the expression, the logicalQuery.Select function enters an infinite loop.
5. The infinite loop consumes excessive CPU resources.
6. The application becomes unresponsive due to CPU exhaustion.
7. Legitimate users are unable to access the application.
8. The system experiences a denial of service.

Impact

Successful exploitation of this vulnerability leads to a denial-of-service condition. An affected server or application becomes unresponsive, impacting all users who rely on the service. While the vulnerability does not directly compromise data confidentiality or integrity, it can severely disrupt operations. The number of potential victims depends on the scope and deployment of applications utilizing the vulnerable antchfx/xpath package.

Recommendation

• Upgrade the antchfx/xpath package to version 1.3.6 or later to patch CVE-2026-32287.
• Deploy the Sigma rule Detect XPath Boolean Expression DoS Attempt to identify attempts to exploit this vulnerability.
• Monitor web server logs for suspicious XPath expressions, particularly those containing “1=1” or “true()”, using the Web Server Log - XPath Boolean Expression Sigma rule.