Boolean XPath expressions that evaluate to true can create an infinite loop in logicalQuery.Select, causing the process to consume 100% CPU. The result is a denial‑of‑service condition for the application or system that hosts the library. The weakness is identified as unreliable input validation (CWE‑606) and infinite loop (CWE‑835).

The vulnerability resides in the antchfx/xpath Go library. All projects that incorporate versions of this library before the patch commit afd4762cc342af56345a3fb4002a59281fcab494 are affected. No specific version range is documented, but any deployment using the library prior to this commit should be considered vulnerable and requires updating.

The CVSS score is 7.5, indicating a medium‑to‑high severity. The EPSS score is below 1%, implying a low probability of real‑world exploitation at present. It is not listed in CISA’s KEV catalog. Likely attack vectors involve supplying a boolean XPath expression, such as "1=1" or "true()", through any user‑controllable input that reaches logicalQuery.Select. If the application processes untrusted requests with this library, an attacker could trigger the loop and exhaust CPU resources, leading to service disruption.