moov-io signedxml vulnerabilities

Latest moov-io signedxml CVEs

Newest publication first

1. CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

   Published 2026-10-20

   High·CVSS 7.5 EPSS 0.46%

   Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlle...

2. CVE-2023-34205 Signature validation bypass in github.com/moov-io/signedxml

   Published 2023-05-30

   Critical·CVSS 9.1 EPSS 0.39%

   In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.