## Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

- 種別: advisory
- 重大度: high
- 関連技術: go, github
- CVE: CVE-2026-113729
- 公開日時: 2026-10-21T16:27:55.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-5588-rp99-5fjh)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-5588-rp99-5fjh

影響: go:github.com/moov-io/signedxml <= 1.4.0 → 1.4.1
Exclusive XML canonicalization (http://www.w3.org/2001/10/xml-exc-c14n#) in github.com/moov-io/signedxml copied the entire accumulated namespace map at every node during ValidateReferences(), before any reference digest or signature check. For a chain of nested elements that each declare many unused namespace prefixes, that produced O(m × depth²) time and peak memory (m = prefixes per level). beevik/etree caps tree depth (~1024), but m is unbounded, so a small attacker-controlled document (on t…