Threats tagged 'ghsa-5588-rp99-5fjh'

CVE-2026-113729 is a high-severity vulnerability in the moov-io signedxml Go library prior to version 1.4.1. The issue involves uncontrolled resource consumption caused by the ExclusiveCanonicalization function copying the entire accumulated namespace map at every nested XML element. An attacker can craft a deeply nested XML document with many unused namespace declarations, causing excessive memory allocation and potentially terminating the process. This vulnerability can be triggered through the ValidateReferences function without requiring a valid signature or authentication. The flaw is fixed in version 1.4.1.