Skip to content
OpenAdvisories

Package · Go

github.com/moov-io/signedxml

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2026-113729

    Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

    Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature check…

    moov-io signedxml github.com/moov-io/signedxml Go
  • Critical 9.1
    CVE-2023-34205

    Signature validation bypass in github.com/moov-io/signedxml

    In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).

    github.com/moov-io/signedxml Go