CVE-2026-18568

The XML::Sig module for Perl (versions 0.29 through 0.71 ) contains a signature verification bypass vulnerability. The issue resides in lib/XML/Sig.pm within the verify function, where the loop fails to record checked elements. Specifically, the code reaches a next statement before performing any...

CVE-2026-9390

The XML::Sig library for Perl (versions before 0.71 ) is vulnerable to XPath injection during ID lookup. The verify() and _get_signed_xml() functions in lib/XML/Sig.pm construct XPath expressions by concatenating the SignedInfo/Reference/@URI value from a document without proper escaping or valid...

CVE-2026-9487

Versions of the XML::Sig Perl module prior to 0.71 are vulnerable to signature wrapping due to an improper handling of duplicate IDs. The root cause resides in the _get_signed_xml() function within lib/XML/Sig.pm, which resolves the SignedInfo Reference/@URI to a node using the XPath expression /...