CVE-2026-18568 Security feature bypass in XML::Sig
Attackers can bypass XML signature verification in Perl XML::Sig by crafting documents that cause all signatures to be skipped, leading to acceptance of unsigned data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18568?
CVE-2026-18568 is a high-severity vulnerability in TIMLEGGE XML::Sig, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check.
verify in lib/XML/Sig.pm counts the `//dsig:Signature` elements into `$numsigs` and iterates over them, but two paths reach `next` before any digest or key check runs: a `SignedInfo/Reference/@URI` that resolves to no element while `$numsigs` is greater than 1, and, when `id_attr` is set, a reference that does not match the requested ID. The loop records nothing about what it checked, so when every signature takes one of those paths control reaches the unconditional `return 1` that ends verify. Two `Signature` elements whose Reference URI names an ID that no element carries is enough, as is one such element combined with `id_attr`.
Any caller that passes untrusted XML to verify can receive a true return for a document in which no digest and no signature value was checked; a `cert` or `cert_text` trust anchor does not change this, because no key check runs. Versions up to 0.28 use an XML::XPath based verify that has no such skip and are not affected.
Weakness: CWE-347
Which versions are affected by CVE-2026-18568?
It affects 1 product.
Products include Xml\ \.
How do I fix CVE-2026-18568?
No fix has been published for CVE-2026-18568 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-18568 being exploited?
There is no known exploitation of CVE-2026-18568 in the wild and no public exploit code.
Other vulnerabilities in TIMLEGGE XML::Sig
- CVE-2025-40934 XML-Sig prior to 0.68 for Perl improperly validates XML without signatures
- CVE-2026-9390 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
- CVE-2026-9487 XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID
- CVE-2012-1102 XML external entity in perl-xml-atom
Sources
Also known as GHSA-r3hj-rg3j-262c.