Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-113729— Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

Quick assessment

Affected
moov-io signedxml
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Moov signedxml 是一个用纯 Go 语言编写的库，用于处理签名的 XML 文档。在 1.4.1 版本之前， 中的 函数会在执行引用摘要或签名检查之前，对每个嵌套元素复制完整的累积命名空间映射。如果攻击者构造的 XML 包含深度嵌套的元素，并在每一层声明大量未使用的命名空间，就会导致内存分配随嵌套深度呈二次方增长、随每层前缀数量呈线性增长。这使得一个相对较小的文档就能消耗数 GB 的内存，从而导致进程终止。该问题可通过 函数触发，且无需有效的签名、匹配的证书或预先的身份认证；同时，该漏洞并不会绕过签名验证

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-113729

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
Source: CVE Program / CVE List V5
Vulnerability Description
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing deeply nested elements with many unused namespace declarations causes quadratic allocation growth with depth and linear growth with prefixes per level, allowing a comparatively small document to consume multiple gigabytes of memory and terminate the process. The condition is reachable through ValidateReferences without a valid signature, matching certificate, or prior authentication, and it does not bypass signature verification. This issue is fixed in version 1.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
moov-io signedxml < 1.4.1 -

II. Public POCs for CVE-2026-113729

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-113729

请登录查看更多情报信息。

Other References for CVE-2026-113729 (3)

IV. Related Vulnerabilities

Same weakness: CWE-400

V. Comments for CVE-2026-113729

No comments yet

Leave a comment