github.com/moov-io/signedxml
Go2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/moov-io/signedxmlpage 1 of 1
- CVE-2023-34205CRITICALCVSS 9.1EG 9.1fixed in 1.1.02023-05-30
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
- CVE-2026-113729HIGHCVSS 7.5EG 7.5fixed in 1.4.12026-10-20
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference diges…
Check whether github.com/moov-io/signedxml is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/moov-io/signedxml CVEs against the assets you own.
Book a Demo →