Moov-io Signedxml up to 1.4.0 Canonicalization exclusivecanonicalization.go ExclusiveCanonicalization allocation of resources

Summaryinfo

A vulnerability was found in Moov-io Signedxml up to 1.4.0. It has been rated as problematic. This vulnerability affects the function ExclusiveCanonicalization of the file exclusivecanonicalization.go of the component Canonicalization. Performing a manipulation results in allocation of resources. This vulnerability is identified as CVE-2026-113729. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Moov-io Signedxml up to 1.4.0. It has been classified as problematic. This affects the function ExclusiveCanonicalization of the file exclusivecanonicalization.go of the component Canonicalization. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing deeply nested elements with many unused namespace declarations causes quadratic allocation growth with depth and linear growth with prefixes per level, allowing a comparatively small document to consume multiple gigabytes of memory and terminate the process. The condition is reachable through ValidateReferences without a valid signature, matching certificate, or prior authentication, and it does not bypass signature verification. This issue is fixed in version 1.4.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-113729 since 10/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 1.4.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Moov-io

Name

• Signedxml

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

Website

• Product: https://github.com/moov-io/signedxml/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion