The vulnerability arises from a programming error in the validateSignature function of goxmldsig, where the address of a loop variable is taken instead of its value. This causes the reference pointer to always point to the last element in the SignedInfo.References slice after the loop, potentially allowing incorrect signature validation. This flaw affects goxmldsig versions before 1.6.0 and Go versions prior to 1.22 or projects using older go.mod versions. The issue is tracked as CWE-347 (Improper Verification of Cryptographic Signature) and CWE-682 (Incorrect Calculation). The vulnerability has a CVSS v3.1 base score of 7.5 (high severity) with network attack vector, low complexity, no privileges or user interaction required, and results in high integrity impact. Red Hat advisories confirm the vulnerability and provide security updates for affected products. A fixed version (1.6.0) of goxmldsig is available.

An attacker could exploit this vulnerability to bypass integrity checks on XML Digital Signatures, potentially allowing unauthorized modification of signed data without detection. This compromises the integrity of applications relying on goxmldsig for XML signature validation. The vulnerability does not affect confidentiality or availability but has a high impact on data integrity.

A fix is available in goxmldsig version 1.6.0. Users should upgrade to version 1.6.0 or later to remediate this vulnerability. Red Hat has released security advisories and updates addressing this issue in their affected products. No alternative mitigations meeting Red Hat's criteria are currently available. Users of affected Red Hat products should apply the provided security updates as soon as possible.