Moov signedxml CVE-2026-113729

Exploitation requires that the target application invoke signedxml's ValidateReferences (which triggers ExclusiveCanonicalization) on attacker-controlled XML - the advisory confirms this path needs no valid signature, matching certificate, or prior authentication. The crafted input must specifically use deeply nested elements each declaring many (largely unused) xmlns namespace prefixes, which drives quadratic allocation growth with depth and linear growth with prefixes per level. Limiting factors: the attacker must be able to deliver XML to a code path that performs exclusive canonicalization (typical for SAML/WS-Federation validation), and the installed signedxml version must be prior to 1.4.1; versions 1.4.1+ reject documents exceeding 8192 in-scope namespaces. Impact is confined to availability (memory exhaustion / process crash) and does not bypass signature verification.

This is a genuine but bounded availability risk - a CWE-400 uncontrolled resource consumption (memory exhaustion) flaw, not a confidentiality or integrity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: the condition is reachable through ValidateReferences over attacker-supplied XML without a valid signature, matching certificate, or prior authentication, so network-reachable, low-complexity, unauthenticated triggering is credible. No EPSS score, CISA KEV listing, or POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - there is no signal of active exploitation. The practical severity is therefore driven by exposure rather than by proven weaponization: any service that calls signedxml's ValidateReferences on untrusted XML (e.g. a SAML/WS-Federation endpoint) can be crashed by a single comparatively small crafted document, but the impact ceiling is process termination, not compromise. Importantly, the advisory explicitly states the issue does NOT bypass signature verification, so this cannot be chained into authentication bypass. Net assessment: patch promptly for internet-facing XML-processing services (easy, pre-auth DoS), but this is availability-only and currently carries no evidence of in-the-wild abuse.

An attacker sends a single crafted XML document - small on the wire but containing deeply nested elements each carrying many unused xmlns declarations - to a service endpoint that passes untrusted input to signedxml's ValidateReferences (such as a SAML assertion consumer). During exclusive canonicalization the library copies the full accumulated namespace map at every nested element, driving quadratic memory growth until the process consumes multiple gigabytes and is terminated by the OS. No valid signature, certificate, or authentication is needed, and no public POC was provided in the input.