{"id":"CVE-2026-113729","aliases":["GHSA-5588-rp99-5fjh"],"url":"https://o3.security/vulnerability/CVE-2026-113729","summary":"Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization","details":"Exclusive XML canonicalization (`http://www.w3.org/2001/10/xml-exc-c14n#`) in `github.com/moov-io/signedxml` copied the entire accumulated namespace map at every node during `ValidateReferences()`, before any reference digest or signature check.\n\nFor a chain of nested elements that each declare many unused namespace prefixes, that produced **O(m × depth²)** time and peak memory (`m` = prefixes per level). `beevik/etree` caps tree depth (~1024), but `m` is unbounded, so a small attacker-controlled document (on the order of 1 MB) could drive multi-gigabyte allocations and OOM the process. No valid signature, matching certificate, or authentication is required.\n\nThis is the library’s core path for SAML / WS-Federation service providers, which canonicalize attacker-supplied XML prior to authentication.\n\n### Affected\n\n- Package: `github.com/moov-io/signedxml`\n- Function: `ExclusiveCanonicalization` (`exclusivecanonicalization.go`)\n- Verified: **v1.4.0** and current default branch (commit `d79064a`). Earlier v1.2.x–v1.3.x releases are likely affected.\n \n\n### Remediation\n\nDo not copy the whole namespace map per node. Maintain a single scope and push/pop only the prefixes introduced at each element. Replace linear prefix-in-scope scans with set lookups. Impose a defensive cap on in-scope namespace declarations and return an error rather than allocating unbounded memory.\n\nFrom @shuji-oh \n```\nThanks for the fix — I re-ran my PoC against this branch and confirmed the memory blowup is gone.\n\nBefore (main)\n\n-- Doubling depth each time (m=10 fixed): allocated grows ~4x each time ≈ O(depth^2) --\ndepth=250  m=10  payload=  0.07MB allocated=     45MB\ndepth=500  m=10  payload=  0.14MB allocated=    179MB\ndepth=1000 m=10  payload=  0.27MB allocated=    711MB\n-- Increasing m (depth=1000 fixed): allocated scales roughly linearly with m --\ndepth=1000 m=5   payload=  0.16MB allocated=    377MB\ndepth=1000 m=100 payload=  2.57MB allocated=   6278MB\nAfter (fix/exc-c14n-namespace-dos)\n\n-- Doubling depth each time (m=10 fixed): allocated grows ~4x each time ≈ O(depth^2) --\ndepth=250  m=10  payload=  0.07MB allocated=      2MB\ndepth=500  m=10  payload=  0.14MB allocated=      4MB\ndepth=1000 m=10  payload=  0.27MB allocated=      7MB\n-- Increasing m (depth=1000 fixed): allocated scales roughly linearly with m --\ndepth=1000 m=5   payload=  0.16MB allocated=      4MB\ndepth=1000 m=100 payload=  2.57MB allocated=     47MB\nThat's roughly a 100–130x reduction in peak allocation for the same payload sizes, and no OOM in any of my runs. This looks like it resolves the issue — thanks for the quick fix!\n```\n\n### Credit\n\nReported by Shuji Ohira ([@shuji-oh](https://github.com/shuji-oh)).","published":"2026-10-20T21:17:55.865Z","modified":"2026-10-21T10:45:27.969136186Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/moov-io/signedxml","fixedVersion":"1.4.1"}],"fix":{"url":"https://github.com/moov-io/signedxml/commit/da2cd6126c4c53b7e59a367d287786e6f6a2d0d3","label":"moov-io/signedxml@da2cd61"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113729.json"},{"type":"FIX","url":"https://github.com/moov-io/signedxml/commit/da2cd6126c4c53b7e59a367d287786e6f6a2d0d3"},{"type":"WEB","url":"https://github.com/moov-io/signedxml/releases/tag/v1.4.1"},{"type":"ADVISORY","url":"https://github.com/moov-io/signedxml/security/advisories/GHSA-5588-rp99-5fjh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113729"},{"type":"PACKAGE","url":"https://github.com/moov-io/signedxml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T10:45:27.969136186Z"}}