What’s Vulnerable › Vulnerabilities

CVE-2026-9487: XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-03 · updated 2026-10-23
• Weakness: CWE-347

Description

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected. Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.

Affected products

• Xml::Sig Project Xml::Sig: before 0.71 — fixed in 0.71

How to fix

Upgrade to a fixed version: Xml::Sig Project Xml::Sig 0.71. Check the vendor advisory for mitigations.

References

• https://github.com/perl-net-saml2/perl-XML-Sig/commit/4976bde5245df69b8e02c6ae061acbd4891cd7f9.patch
• https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/source/Changes

Get alerted when CVE-2026-9487 or the next vulnerability affects your stack