Log in Start free

Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M

CVE-2026-33487goxmldsig has validateSignature Loop Variable Capture Signature Bypass

High 7.5

In plain English

A high-severity security flaw in goxmldsig from russellhaering. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 74.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in `validate.go` goes through the references in the `SignedInfo` block to find one that matches the signed element's ID. In Go versions before 1.22, or when `go.mod` uses an older version, there is a loop variable capture issue. The code takes the address of the loop variable `_ref` instead of its value. As a result, if more than one reference matches the ID or if the loop logic is incorrect, the `ref` pointer will always end up pointing to the last element in the `SignedInfo.References` slice after the loop. goxmlsig version 1.6.0 contains a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/russellhaering/goxmldsig1.6.0GHSA-479m-364c-43vc
Gogithub.com/russellhaering/goxmldsig1.6.0GO-2026-4753

Affected products (as reported)

VendorProductVersions
russellhaering goxmldsig < 1.6.0

Weakness: CWE-347, CWE-682 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References