CVE-2025-40934: XML-Sig prior to 0.68 for Perl improperly validates XML without signatures
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
An attacker can remove the signature from the XML document to make it pass the verification check.
XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
Affected Software
Remediation
Information
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40934?
CVE-2025-40934 is considered a high severity vulnerability due to its potential to allow attackers to bypass XML signature validation.
How do I fix CVE-2025-40934?
To fix CVE-2025-40934, update to XML-Sig version 0.68 or later where the validation of signatures has been corrected.
Who is affected by CVE-2025-40934?
CVE-2025-40934 affects users of XML-Sig versions 0.27 through 0.67 for Perl.
What is the impact of CVE-2025-40934?
The impact of CVE-2025-40934 allows an attacker to submit unsigned XML documents that pass verification, potentially leading to unauthorized actions.
What is XML-Sig in relation to CVE-2025-40934?
XML-Sig is a Perl module designed to validate signatures on XML documents, which is compromised in CVE-2025-40934 if the required signatures are omitted.