VULNERABILITY INTELLIGENCE

CVE-2025-40934

CVSS score9.3 CRITICAL
EPSS probability0.18%
CISA KEVNot currently listed
Published2025-11-26
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Description

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files.  An unsigned XML file should return an error message.  The affected versions return true when attempting to validate an XML file that contains no signatures.

Weakness classification

  • CWE-347: Improper Verification of Cryptographic Signature

Primary references