xml-security vulnerabilities

2 known vulnerabilities in xml-security from Simplesamlphp. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  xml-security: Improper Validation of Integrity Check Value

  CVE-2026-32600Mar 16, 2026Simplesamlphp

  xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can use this to

• 7.5 High severity

  xml-security: Insufficient Verification of Data Authenticity

  CVE-2023-49087Nov 30, 2023Simplesamlphp

  xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the