What is the CVSS score of CVE-2026-4645?

CVE-2026-4645 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Debian are affected by CVE-2026-4645?

A denial-of-service vulnerability in the XPath processing library affects multiple Red Hat products including OpenShift and Kubernetes environments.. A patch is available.

How to fix or mitigate CVE-2026-4645?

Within 24 hours: Inventory all systems running affected Red Hat products (Compliance Operator, File Integrity Operator, Migration Toolkit for Applications 8, OpenShift Container Platform 4, Advanced Cluster Management for Kubernetes 2) and assess exposure. Within 7 days: Apply vendor patches when released by Red Hat; implement network access controls to restrict XPath input sources if patches are unavailable. Within 30 days: Complete patching across all affected systems and validate patch deployment through security testing.

Debian CVE-2026-4645

EUVD-2026-14434 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-03-23 redhat

GHSA-x7cq-7pqm-2pgr

Denial Of Service Debian Suse

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 23, 2026 - 14:00 euvd

EUVD-2026-14434

Analysis Generated

Mar 23, 2026 - 14:00 vuln.today

CVE Published

Mar 23, 2026 - 13:35 nvd

HIGH 7.5

DescriptionCVE.org

A flaw was found in the github.com/antchfx/xpath component. A remote attacker could exploit this vulnerability by submitting crafted Boolean XPath expressions that evaluate to true. This can cause an infinite loop in the logicalQuery.Select function, leading to 100% CPU utilization and a Denial of Service (DoS) condition for the affected system.

AnalysisAI

The antchfx/xpath component in Debian is vulnerable to denial of service when processing specially crafted Boolean XPath expressions, which trigger an infinite loop in the logicalQuery.Select function consuming 100% CPU resources. Unauthenticated remote attackers can exploit this over the network without user interaction to disable affected systems. No patch is currently available.

Technical ContextAI

The vulnerability exists in the github.com/antchfx/xpath library, a Go implementation for XPath query evaluation. The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop) in the logicalQuery.Select function. When processing Boolean XPath expressions, the function fails to properly handle certain true-evaluating conditions, leading to an unbounded loop. Affected products include Red Hat Compliance Operator (cpe:2.3:a:red_hat:compliance_operator), Red Hat File Integrity Operator (cpe:2.3:a:red_hat:file_integrity_operator), and Red Hat Migration Toolkit for Applications 8 (cpe:2.3:a:red_hat:migration_toolkit_for_applications_8) across Red Hat Enterprise Linux 9 and 10, as well as OpenShift Container Platform 4, OpenShift Distributed Tracing 3, and Advanced Cluster Management for Kubernetes 2 environments. The vulnerability impacts any application using this XPath library to process untrusted XPath queries.

RemediationAI

Update the github.com/antchfx/xpath library to a version containing the fix committed in https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494. For Red Hat product users, monitor https://access.redhat.com/security/cve/CVE-2026-4645 for vendor-specific patches and apply updates as they become available for Compliance Operator, File Integrity Operator, Migration Toolkit for Applications 8, OpenShift Container Platform 4, Advanced Cluster Management for Kubernetes 2, and OpenShift Distributed Tracing 3. As an interim mitigation, implement input validation and sanitization for XPath expressions before processing, restrict access to XPath query interfaces to trusted sources only, and deploy rate limiting or resource constraints to prevent complete CPU exhaustion. Consider implementing application-level timeouts for XPath query execution to contain the impact of infinite loops.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all

CVE-2024-20353 HIGH POC

8.6

CVE-2017-16944 HIGH POC

7.5

CVE-2022-0778 HIGH POC

7.5

CVE-2024-43366 CRITICAL POC

9.1

CVE-2026-25533 HIGH POC

8.8

CVE-2018-8002 HIGH POC

8.8

CVE-2017-15223 MEDIUM POC

5.3

CVE-2025-71329 HIGH POC

8.7

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

Debian

golang-github-antchfx-xpath

Release	Status	Fixed Version	Urgency
bookworm, bullseye	vulnerable	1.1.2-2	-
trixie	vulnerable	1.3.3-1	-
forky, sid	fixed	1.3.6-1	-
(unstable)	fixed	1.3.6-1	-

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed

CVE-2026-4645 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5	Fixed
SUSE Linux Enterprise Module for Public Cloud 15 SP4	Fixed
SUSE Linux Enterprise Module for Public Cloud 15 SP5	Fixed
SUSE Linux Enterprise Server 15 SP4	Fixed
SUSE Linux Enterprise Server 15 SP5	Fixed
SUSE Manager Proxy 4.3	Fixed
SUSE Manager Retail Branch Server 4.3	Fixed
SUSE Manager Server 4.3	Fixed
SUSE Enterprise Storage 7	Fixed
SUSE Enterprise Storage 7.1	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP2	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3	Fixed
SUSE Linux Enterprise Module for Public Cloud 15 SP2	Fixed
SUSE Linux Enterprise Module for Public Cloud 15 SP3	Fixed
SUSE Linux Enterprise Server 15 SP2	Fixed
SUSE Linux Enterprise Server 15 SP3	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP2	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP3	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Manager Proxy 4.1	Fixed
SUSE Manager Proxy 4.2	Fixed
SUSE Manager Retail Branch Server 4.1	Fixed
SUSE Manager Retail Branch Server 4.2	Fixed
SUSE Manager Server 4.1	Fixed
SUSE Manager Server 4.2	Fixed
openSUSE Leap 15.3	Fixed
openSUSE Leap 15.4	Fixed
openSUSE Leap 15.5	Fixed

Debian CVE-2026-4645

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

Same technique Denial Of Service

Vendor StatusVendor

Debian

SUSE

Share

External POC / Exploit Code