xpath denial of service

The xpath denial of service tag covers vulnerabilities where specially crafted XPath expressions cause a denial-of-service condition. The primary example is CVE-2026-4645, a flaw in the Go XPath library github.com/antchfx/xpath. Boolean XPath expressions can trigger total loss of availability, meaning an attacker can fully deny access to resources in the impacted component. This can occur during processing or leave the service persistently unavailable. Such bugs are characterized by small inputs causing disproportionate impact, similar to other parser and query-language DoS issues. The tag is relevant for developers and security professionals working with XPath processing in Go or related environments.