PT-2026-27134 · Red Hat · Compliance Operator+7

Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-4645

NVD

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in the github.com/antchfx/xpath component. A remote attacker could exploit this vulnerability by submitting crafted Boolean XPath expressions that evaluate to true. This can cause an infinite loop in the logicalQuery.Select function, leading to 100% CPU utilization and a Denial of Service (DoS) condition for the affected system.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-4645

Affected Products

Compliance Operator

File Integrity Operator

Migration Toolkit For Applications 8

Red Hat Advanced Cluster Management For Kubernetes 2

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 9

Red Hat Openshift Container Platform 4

Red Hat Openshift Distributed Tracing 3

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-4645 · Security Note
• https://github.com/golang/vulndb/issues/4526 · Note
• https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2450214 · Note
• https://access.redhat.com/security/cve/CVE-2026-4645 · Note
• https://github.com/antchfx/xpath/issues/121 · Note