signedxml vulnerabilities

CVEs whose affected-version data names the signedxml package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-113729High· 7.5

yesterday

Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference dig…

▾ Twilightmoov-io · signedxmlvia CVEORG