Moov Signedxml: Unauthenticated Denial Of Service In Exclusive XML Canonicalization

Exclusive XML canonicalization "http://www.w3.org/2001/10/xml-exc-c14n" in "github.com/moov-io/signedxml" copied the entire accumulated namespace map at every node during "ValidateReferences", before any reference digest or signature check. For a chain of nested elements that each declare many...

GHSA-5588-RP99-5FJH Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Exclusive XML canonicalization http://www.w3.org/2001/10/xml-exc-c14n in github.com/moov-io/signedxml copied the entire accumulated namespace map at every node during ValidateReferences, before any reference digest or signature check. For a chain of nested elements that each declare many unused...

EUVD-2026-105774

Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization...

Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Exclusive XML canonicalization http://www.w3.org/2001/10/xml-exc-c14n in github.com/moov-io/signedxml copied the entire accumulated namespace map at every node during ValidateReferences, before any reference digest or signature check. For a chain of nested elements that each declare many unused...

CVE-2026-113729

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing...

CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing...

CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing...

CVE-2026-113729

The Moov signedxml pure Go library (prior to version 1.4.1 ) is vulnerable to an unauthenticated denial of service in its ExclusiveCanonicalization function. The root cause is that exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before performing...

CVE-2026-113729

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing...

CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing...

PT-2026-119528

Name of the Vulnerable Software and Affected Versions Moov signedxml versions prior to 1.4.1 Description An issue exists in the ExclusiveCanonicalization function within exclusivecanonicalization.go where the accumulated namespace map is copied at every nested element before reference digest or...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the CheckSignedInfoKeyedHashAlgorithm method of SignedXml, which compares only the first SignatureValue.Length bytes of the computed HMAC against the supplied signature value. An...

EUVD-2023-1572

Malicious code in bioql PyPI...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

GO-2023-1826 Signature validation bypass in github.com/moov-io/signedxml

Signature validation canonicalizes the input XML document before validating the signature. Parsing the uncanonicalized and canonicalized forms can produce different results. An attacker can exploit this variation to bypass signature validation. Users of signature validation must only parse the...

GHSA-JQVR-J2VG-GJRV Signature validation bypass in github.com/moov-io/signedxml

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

Signature validation bypass in github.com/moov-io/signedxml

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

Input validation

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...