VULNERABILITY INTELLIGENCE

CVE-2026-32313

CVSS score8.2 HIGH

EPSS probability0.16%

CISA KEVNot currently listed

Published2026-03-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Description

xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Prior to 3.1.5, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can use this to brute-force an authentication tag, recover the GHASH key, and decrypt the encrypted nodes. It also allows to forge arbitrary ciphertexts without knowing the encryption key. This vulnerability is fixed in 3.1.5.

Weakness classification

security-advisories@github.com: CWE-354

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Product
security-advisories@github.com — Exploit, Vendor Advisory