Signature Wrapping Vulnerability in Perl's XML::Sig Product by Perl
CVE-2026-9487
Currently unrated
What is CVE-2026-9487?
The XML::Sig library for Perl, specifically versions prior to 0.71, is prone to a signature wrapping vulnerability, allowing attackers to exploit duplicate ID values in XML documents. The function _get_signed_xml() retrieves the first node that matches an ID, failing to identify duplicates. This enables attackers to manipulate signed XML documents, successfully validating attacks in contexts like SAML2, where the legitimate ID is overridden by an attacker-controlled node. It is critical for developers to upgrade to the latest version to mitigate these security risks.
Affected Version(s)
XML::Sig 0 < 0.71