CVE-2023-44483 Apache Santuario: Private Key disclosure in debug-log output

Medium 6.5 Published 20 Oct 2023 Updated 3 Nov 2025

Attackers can read private keys from log files if debug logging is enabled during XML signature generation in Apache Santuario.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-44483?

CVE-2023-44483 is a medium-severity vulnerability in Apache Santuario, published on 20 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

Weakness: CWE-532

Which versions are affected by CVE-2023-44483?

6 open source packages ship an affected version, including org.apache.santuario:xmlsec. It affects 1 product.

Package	Affected	Fixed in
`org.apache.santuario:xmlsec` Maven	All versions	`2.2.6`
`org.apache.santuario:xmlsec` Maven	All versions	`2.2.6`
`org.apache.santuario:xmlsec` Maven	From `2.3.0`	`2.3.4`
`org.apache.santuario:xmlsec` Maven	From `2.3.0`	`2.3.4`
`org.apache.santuario:xmlsec` Maven	From `3.0.0`	`3.0.3`
`org.apache.santuario:xmlsec` Maven	From `3.0.0`	`3.0.3`

Products include Apache Santuario Xml Security for Java.

How do I fix CVE-2023-44483?

Upgrade org.apache.santuario:xmlsec to a fixed version for your release line: 2.2.6, 2.3.4 or 3.0.3.

Is CVE-2023-44483 being exploited?

There is no known exploitation of CVE-2023-44483 in the wild and no public exploit code.

Sources

Also known as CLSA-2024-1727136003, DEBIAN-CVE-2023-44483, GHSA-xfrj-6vvc-3xm2, OESA-2025-2380, OESA-2025-2381, OESA-2025-2382 and 4 more.