Signature Verification Bypass in XML::Sig for Perl
CVE-2026-18568
Currently unrated
What is CVE-2026-18568?
The XML::Sig library for Perl, specifically versions from 0.29 to 0.71, contains a vulnerability that allows attackers to bypass signature verification. This issue occurs when the library's verification method skips cryptographic checks due to specific conditions related to the Reference URI or ID comparisons. As a result, an attacker could supply untrusted XML and receive a 'true' return from the verification function without any valid digest or signature value being checked. This flaw places users at risk, making it crucial to upgrade to the patched version, 0.72, to mitigate potential exploits.
Affected Version(s)
XML::Sig 0.29 < 0.72