Vulnerability · Published Nov 26, 2025 · Assigned by CPANSec
CVE-2025-40934XML-Sig prior to 0.68 for Perl improperly validates XML without signatures
Critical 9.3
In plain English
A critical-severity security flaw in XML::Sig from TIMLEGGE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | perl-xml-sig | 0.68-r0 | ALPINE-CVE-2025-40934 |
| Alpine:v3.23 | perl-xml-sig | 0.68-r0 | ALPINE-CVE-2025-40934 |
| Alpine:v3.24 | perl-xml-sig | 0.68-r0 | ALPINE-CVE-2025-40934 |
Affected products (as reported)
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N