CPANSA-XML-Sig-2026-9487: XML-Sig vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-08-03T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-08-03T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 9.1 | Severity | Critical |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.
_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.
Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.
Vulnerabilities
CVE-2026-9487
Vulnerability DescriptionXML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.
_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.
Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.
| Weakness | CWE-347 : Improper Verification of Cryptographic Signature |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| XML-Sig less than 0.71 |
|
Fixed
- XML-Sig greater than or equal 0.71
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-XML-Sig-2026-9487 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-xml-sig-2026-9487.json - https://github.com/perl-net-saml2/perl-XML-Sig/commit/4976bde5245df69b8e02c6ae061acbd4891cd7f9.patch external
https://github.com/perl-net-saml2/perl-XML-Sig/commit/4976bde5245df69b8e02c6ae061acbd4891cd7f9.patch - https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/source/Changes external
https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/source/Changes - CVE-2026-9487 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-9487
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Mon Aug 3 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/