How to fix CVE-2025-48995?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Is Python affected by CVE-2025-48995?

Organizations using SignXML should be aware of notable risk from CVE-2025-48995 rated CVSS 6.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

CVE-2025-48995

EUVD-2025-16676 MEDIUM

2025-06-02 [email protected]

GHSA-gmhf-gg8w-jw42

6.9

CVSS 4.0

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Patch Released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16676

CVE Published

Jun 02, 2025 - 17:15 nvd

MEDIUM 6.9

Description

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing it with the user supplied hash, allowing users to reconstruct the correct HMAC for any data.

Analysis

A security vulnerability in SignXML (CVSS 6.9). Remediation should follow standard vulnerability management procedures.

Technical Context

Vulnerability type not specified by vendor. Affects SignXML.

Affected Products

['SignXML']

Remediation

Monitor vendor channels for patch availability.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +34

POC: 0

Vendor Status

Ubuntu

Priority: Medium

python-signxml

Release	Status	Version
focal	DNE	-
jammy	DNE	-
noble	DNE	-
oracular	DNE	-
upstream	needs-triage	-
plucky	ignored	end of life, was needs-triage
questing	needs-triage	-

Debian

Bug #1107195

python-signxml

Release	Status	Fixed Version	Urgency
trixie	fixed	4.0.5+dfsg-2	-
forky, sid	fixed	4.2.0+dfsg-1	-
(unstable)	fixed	4.0.5+dfsg-1	-

CVE-2025-48995 vulnerability details – vuln.today

Back

CVE-2025-48995

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Vendor Status

Ubuntu

Debian

Share

CVE-2025-48995

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Vendor Status

Ubuntu

Debian

Share

External POC / Exploit Code