EUVD-2026-105774

Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization...

CVE-2026-113729

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing...

CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing...

CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing...

CVE-2026-113729

The Moov signedxml pure Go library (prior to version 1.4.1 ) is vulnerable to an unauthenticated denial of service in its ExclusiveCanonicalization function. The root cause is that exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before performing...

CVE-2026-113729

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing...

CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing...

PT-2026-119528

Name of the Vulnerable Software and Affected Versions Moov signedxml versions prior to 1.4.1 Description An issue exists in the ExclusiveCanonicalization function within exclusivecanonicalization.go where the accumulated namespace map is copied at every nested element before reference digest or...

EUVD-2023-1572

Malicious code in bioql PyPI...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

GHSA-JQVR-J2VG-GJRV Signature validation bypass in github.com/moov-io/signedxml

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

Moov signedxml data manipulation vulnerability

signedxml is moov open source a pure go library for processing signed XML documents . Moov signedxml version 1.0.0 and earlier versions of a security vulnerability , the vulnerability stems from parsing the original XML may lead to parsing the canonicalized XML with a different output , an attack...

CVE-2023-34205: Improper Verification of Cryptographic Signature

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

PT-2023-24736 · Moov · Signedxml

Name of the Vulnerable Software and Affected Versions: Moov signedxml versions 1.0.0 and earlier Description: The issue arises from the difference in output when parsing raw XML versus canonicalized XML, allowing an attacker to bypass signature validation through a Signature Wrapping attack. This...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

CVE-2023-34205 affects moov-io/signedxml up to version 1.0.0, where parsing raw vs canonicalized XML can produce different outputs, enabling a Signature Wrapping (XSW) bypass of signature validation. The issue is documented across multiple feeds (NVD, Red Hat, GHSA, OSV) with a high CVSS (CRITICA...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...