CVE-2026-18568

The XML::Sig module for Perl (versions 0.29 through 0.71 ) contains a signature verification bypass vulnerability. The issue resides in lib/XML/Sig.pm within the verify function, where the loop fails to record checked elements. Specifically, the code reaches a next statement before performing any...

CVE-2026-9390

The XML::Sig library for Perl (versions before 0.71 ) is vulnerable to XPath injection during ID lookup. The verify() and _get_signed_xml() functions in lib/XML/Sig.pm construct XPath expressions by concatenating the SignedInfo/Reference/@URI value from a document without proper escaping or valid...

CVE-2026-9487

Versions of the XML::Sig Perl module prior to 0.71 are vulnerable to signature wrapping due to an improper handling of duplicate IDs. The root cause resides in the _get_signed_xml() function within lib/XML/Sig.pm, which resolves the SignedInfo Reference/@URI to a node using the XPath expression /...

CVE-2025-40934

The XML-Sig Perl module (versions 0.27 through 0.67) contains a vulnerability where it incorrectly validates XML files if signatures are omitted. Specifically, the verify function in lib/XML/Sig.pm may return true for unsigned documents because the loop reaches an unconditional return 1 if every ...