CVE-2026-9487

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-9487
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9487.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-9487
Published
2026-08-03T13:14:43Z
Modified
2026-08-12T03:51:25Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID
Details

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.

_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.

Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9487.json"
}
References

Affected packages

Git / github.com/perl-net-saml2/perl-xml-sig

Affected ranges

Type
GIT
Repo
https://github.com/perl-net-saml2/perl-xml-sig
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7ac376f7377495e38b97e5a83c29b41c8f718b8a
Fixed
4976bde5245df69b8e02c6ae061acbd4891cd7f9
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:xml\\:\\:sig_project:xml\\:\\:sig:*:*:*:*:*:perl:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.71"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1
0.2
0.2.1
0.21
0.22
0.23
0.30-TRIAL
0.31-TRIAL
0.32
0.33
0.35-TRIAL
0.36
0.37-TRIAL
0.38
0.39
0.40-TRIAL
0.41-TRIAL
0.42-TRIAL
0.43
0.44-TRIAL
0.45
0.46-TRIAL
0.47
0.48-TRIAL
0.49
0.50
0.51
0.52
0.53
0.54
0.55
0.56
0.57
0.58
0.59
0.60
0.61
0.62
0.63
0.64
0.65
0.66
0.67
0.68
0.69
0.70
v0.*
v0.40-TRIAL

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9487.json"