Memory Exhaustion in Moov SignedXML Library

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description

Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks. Attacker-controlled XML containing deeply nested elements with many unused namespace declarations causes quadratic allocation growth with depth and linear growth with prefixes per level, allowing a comparatively small document to consume multiple gigabytes of memory and terminate the process. The condition is reachable through ValidateReferences without a valid signature, matching certificate, or prior authentication, and it does not bypass signature verification. This issue is fixed in version 1.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-113729

Affected Vendors & Products

Vendor	Product	Version / Range
moov-io	signedxml	< 1.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability affects Moov signedxml, a Go library for processing signed XML documents. The issue is in the ExclusiveCanonicalization function, which copies namespace declarations at every nested XML element. Attackers can exploit this by sending deeply nested XML with many unused namespaces, causing excessive memory usage that grows quadratically with depth and linearly with prefixes per level. This leads to denial of service by consuming gigabytes of memory and crashing the process.

Impact Analysis

If you use the vulnerable version of Moov signedxml, an attacker could send a specially crafted XML document to your application. This could cause your system to run out of memory and crash, leading to service disruption. The attack does not require valid signatures, certificates, or authentication, making it accessible to any remote attacker.

Mitigation Strategies

Update the Moov signedxml library to version 1.4.1 or later to address the memory exhaustion issue caused by ExclusiveCanonicalization.

Hi! I’m here to help you understand CVE-2026-113729. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70