Boolean XPath expressions that evaluate to true trigger an infinite loop in the logicalQuery.Select routine within the github.com/antchfx/xpath package. This loop consumes 100 % of CPU resources, potentially halting application responsiveness and disrupting services. The flaw represents a classic Resource Exhaustion vulnerability that allows an attacker to cause a denial‑of‑service condition, although it does not directly enable code execution or privilege escalation.

The affected product is the Go library github.com/antchfx/xpath. No specific version range is provided in the public advisory, but the issue exists in any release that includes the buggy loop. Projects that import this library as a dependency—especially those that evaluate user‑supplied XPath expressions—are at risk.

The available CVSS or EPSS metrics are not supplied, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote code that supplies a malicious XPath expression; such an expression can be crafted as a top‑level selector such as "1=1" or "true()". Based on the description, exploitation would require an attacker to be able to influence the XPath query used by an application that depends on the library. Because the issue results in a denial‑of‑service rather than privilege escalation, the overall threat is moderate but could be high for critical services that rely on this library.