CVE-2025-40934

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-40934

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40934.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-40934

Published

2025-11-26T23:15:47.773Z

Modified

2026-04-10T05:26:59.652361Z

Severity

9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N CVSS Calculator

Summary

[none]

Details

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.

An attacker can remove the signature from the XML document to make it pass the verification check.

XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.

References

Affected packages

Git / github.com/perl-net-saml2/perl-xml-sig

Affected ranges

Type

GIT

Repo

https://github.com/perl-net-saml2/perl-xml-sig

Events

Introduced

89dd4fe13fadcb751b9deca1b0308cf9ef7e137c

Last affected

2d342de96b7d16c7d7c1ba3deb73068a6a975b0d

Database specific

{
    "versions": [
        {
            "introduced": "0.27"
        },
        {
            "last_affected": "0.67"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40934.json"