Vulnerabilities

TI-2026-25883 CVE-2026-33487 · GHSA-479m-364c-43vc

goxmldsig has validateSignature Loop Variable Capture Signature Bypass

HIGH 72

goxmlsig provides XML Digital Signatures implemented in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00322 Published 2026-03-26 Fixed in 1.6.0 CWE-347

TI-2020-11988 CVE-2020-15216 · GHSA-q547-gmf8-8jr7

Signature Validation Bypass in goxmldsig

LOW 31

In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00898 Published 2020-09-29 Partial fix · 1.1.0 CWE-347

TI-2020-06231 CVE-2020-7711 · GHSA-mqqv-chpx-vq25

Denial of service (DoS) in github.com/russellhaering/goxmldsig

LOW 36

This affects all versions of package github.com/russellhaering/goxmldsig.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01804 Published 2020-08-23 Partial fix · 1.1.1, 0.7.0 CWE-476

Vulnerabilities

Filters

goxmldsig has validateSignature Loop Variable Capture Signature Bypass

Signature Validation Bypass in goxmldsig

Denial of service (DoS) in github.com/russellhaering/goxmldsig