{"id":"CVE-2026-33487","title":"goxmlsig provides XML Digital Signatures implemented in Go","summary":"goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in `validate.go` goes through the references in the `SignedInfo` block to find one that matches the signed element's ID.…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-347","CWE-682"],"vendor":"goxmldsig_project","product":"goxmldsig","affected":["goxmldsig < 1.6.0"],"patched":["goxmldsig 1.6.0"],"published":"2026-03-26","updated":"2026-09-09","sourceUpdated":"2026-09-09T13:19:24.923","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33487","references":[{"url":"https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:13548","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20943","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20946","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22423","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33487","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451814","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33487.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33487"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33487"},{"url":"https://github.com/russellhaering/goxmldsig"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat","osv","go"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-03-30T11:16:13.379400Z"},"epss":0.00299,"epssPercentile":0.22712,"ingestedAt":"2026-07-10T01:55:22.971Z","aliases":["GHSA-479m-364c-43vc","GO-2026-4753"],"ecosystem":"go","slug":"CVE-2026-33487","body":"## Overview\n\ngoxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in `validate.go` goes through the references in the `SignedInfo` block to find one that matches the signed element's ID. In Go versions before 1.22, or when `go.mod` uses an older version, there is a loop variable capture issue. The code takes the address of the loop variable `_ref` instead of its value. As a result, if more than one reference matches the ID or if the loop logic is incorrect, the `ref` pointer will always end up pointing to the last element in the `SignedInfo.References` slice after the loop. goxmlsig version 1.6.0 contains a patch.\n\n## Affected\n\n- `goxmldsig < 1.6.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `goxmldsig 1.6.0`\n\n## Vendor advisories\n\n- **RHSA-2026:22423** · Red Hat · fixed in: Multicluster Global Hub 1.3.4 · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22423)\n- **RHSA-2026:22347** · Red Hat · fixed in: Multicluster Global Hub 1.4.5 · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22347)\n- **RHSA-2026:23345** · Red Hat · fixed in: Multicluster Global Hub 1.6.5 · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23345)\n- **RHSA-2026:36882** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36882)\n- **RHSA-2026:13548** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13548)\n- **RHSA-2026:20946** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.18 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20946)\n- **RHSA-2026:20943** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.19 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20943)\n- **RHSA-2026:21769** · Red Hat · fixed in: Red Hat multicluster global hub 1.5.3 · released 2026-05-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:21769)\n\n## Package advisory (CVE-2026-33487)\n\nAffected packages:\n\n- `github.com/russellhaering/goxmldsig < 1.6.0`\n\nPatched in:\n\n- `github.com/russellhaering/goxmldsig 1.6.0`\n\nSource: https://osv.dev/vulnerability/GHSA-479m-364c-43vc","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201604,"id":"CVE-2026-33487","ts":1789399526604,"field":"exploit_available","old":"false","new":"true"},{"seq":200336,"id":"CVE-2026-33487","ts":1789397122810,"field":"exploit_available","old":"true","new":"false"},{"seq":198260,"id":"CVE-2026-33487","ts":1789391763295,"field":"exploit_available","old":"false","new":"true"},{"seq":196053,"id":"CVE-2026-33487","ts":1789383417656,"field":"exploit_available","old":"true","new":"false"},{"seq":194982,"id":"CVE-2026-33487","ts":1789380327904,"field":"exploit_available","old":"false","new":"true"},{"seq":193769,"id":"CVE-2026-33487","ts":1789378283494,"field":"exploit_available","old":"true","new":"false"},{"seq":192556,"id":"CVE-2026-33487","ts":1789376249026,"field":"exploit_available","old":"false","new":"true"},{"seq":191343,"id":"CVE-2026-33487","ts":1789373151430,"field":"exploit_available","old":"true","new":"false"},{"seq":190128,"id":"CVE-2026-33487","ts":1789369139790,"field":"exploit_available","old":"false","new":"true"},{"seq":188915,"id":"CVE-2026-33487","ts":1789368052764,"field":"exploit_available","old":"true","new":"false"},{"seq":187698,"id":"CVE-2026-33487","ts":1789365013182,"field":"exploit_available","old":"false","new":"true"},{"seq":186485,"id":"CVE-2026-33487","ts":1789363027335,"field":"exploit_available","old":"true","new":"false"},{"seq":185271,"id":"CVE-2026-33487","ts":1789360973652,"field":"exploit_available","old":"false","new":"true"},{"seq":184058,"id":"CVE-2026-33487","ts":1789357953275,"field":"exploit_available","old":"true","new":"false"},{"seq":182310,"id":"CVE-2026-33487","ts":1789354110818,"field":"exploit_available","old":"false","new":"true"},{"seq":181103,"id":"CVE-2026-33487","ts":1789352966059,"field":"exploit_available","old":"true","new":"false"},{"seq":179896,"id":"CVE-2026-33487","ts":1789350015501,"field":"exploit_available","old":"false","new":"true"},{"seq":178689,"id":"CVE-2026-33487","ts":1789347841428,"field":"exploit_available","old":"true","new":"false"},{"seq":177482,"id":"CVE-2026-33487","ts":1789346192359,"field":"exploit_available","old":"false","new":"true"},{"seq":176275,"id":"CVE-2026-33487","ts":1789342764450,"field":"exploit_available","old":"true","new":"false"},{"seq":176059,"id":"CVE-2026-33487","ts":1789342378724,"field":"exploit_available","old":"false","new":"true"},{"seq":175599,"id":"CVE-2026-33487","ts":1789338394128,"field":"exploit_available","old":"true","new":"false"},{"seq":174394,"id":"CVE-2026-33487","ts":1789334608174,"field":"exploit_available","old":"false","new":"true"},{"seq":173189,"id":"CVE-2026-33487","ts":1789333222923,"field":"exploit_available","old":"true","new":"false"},{"seq":172003,"id":"CVE-2026-33487","ts":1789330904786,"field":"exploit_available","old":"false","new":"true"},{"seq":170817,"id":"CVE-2026-33487","ts":1789328409892,"field":"exploit_available","old":"true","new":"false"},{"seq":169612,"id":"CVE-2026-33487","ts":1789326925409,"field":"exploit_available","old":"false","new":"true"},{"seq":168407,"id":"CVE-2026-33487","ts":1789323464224,"field":"exploit_available","old":"true","new":"false"},{"seq":167202,"id":"CVE-2026-33487","ts":1789319386584,"field":"exploit_available","old":"false","new":"true"},{"seq":165997,"id":"CVE-2026-33487","ts":1789318312878,"field":"exploit_available","old":"true","new":"false"},{"seq":164792,"id":"CVE-2026-33487","ts":1789315556424,"field":"exploit_available","old":"false","new":"true"},{"seq":163587,"id":"CVE-2026-33487","ts":1789313278402,"field":"exploit_available","old":"true","new":"false"},{"seq":162382,"id":"CVE-2026-33487","ts":1789311723746,"field":"exploit_available","old":"false","new":"true"},{"seq":161177,"id":"CVE-2026-33487","ts":1789308288868,"field":"exploit_available","old":"true","new":"false"},{"seq":160682,"id":"CVE-2026-33487","ts":1789304213596,"field":"exploit_available","old":"false","new":"true"},{"seq":158520,"id":"CVE-2026-33487","ts":1789299305228,"field":"exploit_available","old":"true","new":"false"},{"seq":157484,"id":"CVE-2026-33487","ts":1789296472151,"field":"exploit_available","old":"false","new":"true"},{"seq":156279,"id":"CVE-2026-33487","ts":1789294406459,"field":"exploit_available","old":"true","new":"false"},{"seq":155074,"id":"CVE-2026-33487","ts":1789292648454,"field":"exploit_available","old":"false","new":"true"},{"seq":153869,"id":"CVE-2026-33487","ts":1789289372522,"field":"exploit_available","old":"true","new":"false"},{"seq":153081,"id":"CVE-2026-33487","ts":1789285285795,"field":"exploit_available","old":"false","new":"true"},{"seq":148015,"id":"CVE-2026-33487","ts":1789270889494,"field":"exploit_available","old":"true","new":"false"},{"seq":146055,"id":"CVE-2026-33487","ts":1789269181794,"field":"exploit_available","old":"false","new":"true"},{"seq":144958,"id":"CVE-2026-33487","ts":1789266127655,"field":"exploit_available","old":"true","new":"false"},{"seq":143862,"id":"CVE-2026-33487","ts":1789262453115,"field":"exploit_available","old":"false","new":"true"},{"seq":142698,"id":"CVE-2026-33487","ts":1789261206470,"field":"exploit_available","old":"true","new":"false"},{"seq":141534,"id":"CVE-2026-33487","ts":1789258623049,"field":"exploit_available","old":"false","new":"true"},{"seq":140336,"id":"CVE-2026-33487","ts":1789256427116,"field":"exploit_available","old":"true","new":"false"},{"seq":139138,"id":"CVE-2026-33487","ts":1789254600682,"field":"exploit_available","old":"false","new":"true"},{"seq":137940,"id":"CVE-2026-33487","ts":1789251597346,"field":"exploit_available","old":"true","new":"false"}]}