CVE-2026-32287
HighAdvisory
Published 17 Mar 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.005
- 43rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 52
- of 17,781 indexed, latest versions
- Container images
- 48
- deployed by those charts
- Fix available
- 1 of 1
- affected package
XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion
Carried by container images the latest versions of 52 of 17,781 indexed charts deploy, on 48 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v1.1.6, v1.1.10, v1.1.11, v1.2.0+9 more | 1.3.6 | 48 |
- OSV records
- GHSA-65xw-vw82-r86x
- Also known as
- GO-2026-4526
Charts affected
52 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| telegraf-ds-k3stelegraf-ds-k3s | 1.0.0 | 1 of 1See more | 3,764 |
| vals-operatorvals-operatorVerified publisher | 0.8.1 | 1 of 1See more | 696 |
Container images carrying it
48 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| grafana/ | 65a578975943 | github.com/ | 1.3.6 | 4 |
| alpine/ | 048f8d9c8cc7 | github.com/ | 1.3.6 | 2 |
| grafana/ | 7790f6f7fbd8 | github.com/ | 1.3.6 | 2 |
| grafana/ | f94b1c82957a | github.com/ | 1.3.6 | 2 |
| otel/ | 32b3c8296dcc | github.com/ | 1.3.6 | 2 |
| alpine/ | 6dbe6f391eda | github.com/ | 1.3.6 | 1 |
| alpine/ | 7a319b15cfc9 | github.com/ | 1.3.6 | 1 |
| alpine/ | 7e1e7d5b7a96 | github.com/ | 1.3.6 | 1 |
| alpine/ | 9c4976d47656 | github.com/ | 1.3.6 | 1 |
| alpine/ | bd01dae02676 | github.com/ | 1.3.6 | 1 |
| alpine/ | cd560fce90f7 | github.com/ | 1.3.6 | 1 |
| alpine/ | e5c0b053fed7 | github.com/ | 1.3.6 | 1 |
| alpine/ | eec354133193 | github.com/ | 1.3.6 | 1 |
| amazon/ | 73b79b02f03a | github.com/ | 1.3.6 | 1 |
| ddosify/ | 181965edb12e | github.com/ | 1.3.6 | 1 |
| ddosify/ | a97a1b8a66af | github.com/ | 1.3.6 | 1 |
| grafana/ | 01a63f4e032c | github.com/ | 1.3.6 | 1 |
| grafana/ | 8c7256f412fe | github.com/ | 1.3.6 | 1 |
| grafana/ | f50931848bd8 | github.com/ | 1.3.6 | 1 |
| grafana/ | 09d8c3ce4f3a | github.com/ | 1.3.6 | 1 |
| jaegertracing/ | e128b9adbb29 | github.com/ | 1.3.6 | 1 |
| library/ | 28e98eece020 | github.com/ | 1.3.6 | 1 |
| library/ | 507a3eecf809 | github.com/ | 1.3.6 | 1 |
| library/ | 794079a7f241 | github.com/ | 1.3.6 | 1 |
| library/ | addb86c0c520 | github.com/ | 1.3.6 | 1 |
| otel/ | 37fa87091cfa | github.com/ | 1.3.6 | 1 |
| otel/ | 3bc07732530c | github.com/ | 1.3.6 | 1 |
| otel/ | 5ac3e0ba2b0b | github.com/ | 1.3.6 | 1 |
| otel/ | a7343f018690 | github.com/ | 1.3.6 | 1 |
| otel/ | faf125d656fa | github.com/ | 1.3.6 | 1 |
| otel/ | 1e45d9483faa | github.com/ | 1.3.6 | 1 |
| stashapp/ | 24dbd7607174 | github.com/ | 1.3.6 | 1 |
| stashapp/ | df744af5a0c9 | github.com/ | 1.3.6 | 1 |
| wait4x/ | 4dcd86307de1 | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | bce133f3f511 | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | b1557553a2b3 | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | 657a2c9f6e6d | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | 7c776499b8c9 | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | 49b1c312e342 | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | aa0c8526ae5e | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | a1d4cf8b8fe1 | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | e3d1f1302e49 | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | ac8459f70f85 | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | af77073c184f | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | 9c7bc0f9bb35 | github.com/ | 1.3.6 | 1 |
| ghcr.io/ | 2434560e8f0e | github.com/ | 1.3.6 | 1 |
| public.ecr.aws/ | 8aa9ea5f67b8 | github.com/ | 1.3.6 | 1 |
| quay.io/ | ec6ab507c5da | github.com/ | 1.3.6 | 1 |