{"schema":"threatline.record/2","record":{"id":"CVE-2026-113729","aliases":["GHSA-5588-rp99-5fjh"],"summary":"Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization","details":"Exclusive XML canonicalization (`http://www.w3.org/2001/10/xml-exc-c14n#`) in `github.com/moov-io/signedxml` copied the entire accumulated namespace map at every node during `ValidateReferences()`, before any reference digest or signature check.\n\nFor a chain of nested elements that each declare many unused namespace prefixes, that produced **O(m × depth²)** time and peak memory (`m` = prefixes per level). `beevik/etree` caps tree depth (~1024), but `m` is unbounded, so a small attacker-controlled document (on the order of 1 MB) could drive multi-gigabyte allocations and OOM the process. No valid signature, matching certificate, or authentication is required.\n\nThis is the library’s core path for SAML / WS-Federation service providers, which canonicalize attacker-supplied XML prior to authentication.\n\n### Affected\n\n- Package: `github.com/moov-io/signedxml`\n- Function: `ExclusiveCanonicalization` (`exclusivecanonicalization.go`)\n- Verified: **v1.4.0** and current default branch (commit `d79064a`). Earlier v1.2.x–v1.3.x releases are likely affected.\n \n\n### Remediation\n\nDo not copy the whole namespace map per node. Maintain a single scope and push/pop only the prefixes introduced at each element. Replace linear prefix-in-scope scans with set lookups. Impose a defensive cap on in-scope namespace declarations and return an error rather than allocating unbounded memory.\n\nFrom @shuji-oh \n```\nThanks for the fix — I re-ran my PoC against this branch and confirmed the memory blowup is gone.\n\nBefore (main)\n\n-- Doubling depth each time (m=10 fixed): allocated grows ~4x each time ≈ O(depth^2) --\ndepth=250  m=10  payload=  0.07MB allocated=     45MB\ndepth=500  m=10  payload=  0.14MB allocated=    179MB\ndepth=1000 m=10  payload=  0.27MB allocated=    711MB\n-- Increasing m (depth=1000 fixed): allocated scales roughly linearly with m --\ndepth=1000 m=5   payload=  0.16MB allocated=    377MB\ndepth=1000 m=100 payload=  2.57MB allocated=   6278MB\nAfter (fix/exc-c14n-namespace-dos)\n\n-- Doubling depth each time (m=10 fixed): allocated grows ~4x each time ≈ O(depth^2) --\ndepth=250  m=10  payload=  0.07MB allocated=      2MB\ndepth=500  m=10  payload=  0.14MB allocated=      4MB\ndepth=1000 m=10  payload=  0.27MB allocated=      7MB\n-- Increasing m (depth=1000 fixed): allocated scales roughly linearly with m --\ndepth=1000 m=5   payload=  0.16MB allocated=      4MB\ndepth=1000 m=100 payload=  2.57MB allocated=     47MB\nThat's roughly a 100–130x reduction in peak allocation for the same payload sizes, and no OOM in any of my runs. This looks like it resolves the issue — thanks for the quick fix!\n```\n\n### Credit\n\nReported by Shuji Ohira ([@shuji-oh](https://github.com/shuji-oh)).","categories":["Libraries & packages"],"product":"github.com/moov-io/signedxml","vendor":"moov-io","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5588-rp99-5fjh","source_modified_at":"2026-10-21T16:27:58Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/moov-io/signedxml"},"range":"<= 1.4.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113729","source_modified_at":"2026-10-20T21:20:30.499Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"signedxml","vendor":"moov-io","versions":[{"status":"affected","version":"< 1.4.1"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5588-rp99-5fjh","source_modified_at":"2026-10-21T16:45:04.150818554Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"github.com/moov-io/signedxml","ecosystem":"Go","purl":"pkg:golang/github.com/moov-io/signedxml"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5588-rp99-5fjh","source_modified_at":"2026-10-21T16:27:58Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/moov-io/signedxml"},"version":"1.4.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5588-rp99-5fjh","source_modified_at":"2026-10-21T16:45:04.150818554Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"github.com/moov-io/signedxml","ecosystem":"Go","purl":"pkg:golang/github.com/moov-io/signedxml"},"version":"1.4.1"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00465,"percentile":0.39326,"score_date":"2026-10-23"},"published_at":"2026-10-20T21:17:55.865Z","modified_at":"2026-10-21T16:45:04.150818554Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-5588-rp99-5fjh","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-21T16:27:58Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-113729","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T21:20:30.499Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-5588-rp99-5fjh","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-21T16:45:04.150818554Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113729","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/moov-io/signedxml/security/advisories/GHSA-5588-rp99-5fjh","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113729","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/moov-io/signedxml/commit/da2cd6126c4c53b7e59a367d287786e6f6a2d0d3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/moov-io/signedxml/releases/tag/v1.4.1","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-5588-rp99-5fjh","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T16:45:04.150818554Z","content_hash":"9e86e494bf6553d3bf4bd1ce303bd84ae565511cb666b99e1159097e79b7d4b0"}}