moov-io vulnerabilities

Products

• signedxml 2
• github.com/moov-io/customers 1

Latest moov-io CVEs

Newest publication first

1. CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

   Published 2026-10-20

   High·CVSS 7.5 EPSS 0.46%

   Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlle...

2. CVE-2023-34205 Signature validation bypass in github.com/moov-io/signedxml

   Published 2023-05-30

   Critical·CVSS 9.1 EPSS 0.39%

   In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).

3. GHSA-g636-q5fc-4pr7 accounts: Hash account number using Salt

   Published 2021-05-24

   Unknown

   @alovak found that currently when we build hash of account number we do not "salt" it. Which makes it vulnerable to rainbow table attack. What did you expect to see? I expected salt (some random number from configuration) to be used in hash.AccountNumber I would generate salt per...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.