CVE-2026-33487

goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the validateSignature function in validate.go goes through the references in the SignedInfo block to find one that matches the signed element's ID. In Go versions before 1.22, or when go.mod uses an older version, there is a loop variable capture issue. The code takes the address of the loop variable _ref instead of its value. As a result, if more than one reference matches the ID or if the loop logic is incorrect, the ref pointer will always end up pointing to the last element in the SignedInfo.References slice after the loop. goxmlsig version 1.6.0 contains a patch.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33487.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-347",
        "CWE-682"
    ]
}

References

Affected packages

Git / github.com/russellhaering/goxmldsig

Affected ranges

Type

GIT

Repo

https://github.com/russellhaering/goxmldsig

Events

Introduced

Fixed

878c8c615feb628064040115d00e105a137fcfa7

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.6.0"
        }
    ]
}

Affected versions

v1.*

v1.1.0

v1.1.1

v1.2.0

v1.3.0

v1.4.0

v1.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33487.json"