CVE-2026-113729 moov-io CVE debrief

Who should care

Defenders responsible for SAML / WS-Federation service providers that use the `github.com/moov-io/signedxml` package should assess their exposure to this vulnerability and prioritize verification and remediation efforts.

Why it matters

CVE-2026-113729 is a denial-of-service vulnerability in the `github.com/moov-io/signedxml` package that can lead to multi-gigabyte allocations and cause the process to run out of memory (OOM). Defenders should prioritize verifying the affected versions and upgrading to version 1.4.1 or later.

• Denial of service (DoS) attacks can be launched against SAML / WS-Federation service providers that use the vulnerable library.
• Successful exploitation can lead to multi-gigabyte allocations and cause the process to run out of memory (OOM).
• Defenders should verify the affected versions of the library and upgrade to version 1.4.1 or later to prevent potential attacks.
• Remediation requires updating the library to version 1.4.1 or later and implementing compensating controls to detect potential attacks.

Technical summary

The `ExclusiveCanonicalization` function in `github.com/moov-io/signedxml` has a vulnerability that can lead to multi-gigabyte allocations and cause the process to run out of memory (OOM). This issue affects SAML / WS-Federation service providers that use this library to canonicalize attacker-supplied XML prior to authentication. The vulnerability arises from the function's inefficient handling of namespace maps during XML canonicalization. Defenders should prioritize verifying the affected versions of the `github.com/moov-io/signedxml` package and upgrading to version 1.4.1 or later. They should also assess their exposure to this vulnerability, particularly if they use SAML / WS-Federation service providers.

Defensive priority

Defenders should prioritize verifying the affected versions of the `github.com/moov-io/signedxml` package and upgrading to version 1.4.1 or later. They should also assess their exposure to this vulnerability, particularly if they use SAML / WS-Federation service providers that rely on this library.

Recommended defensive actions

• Verify the version of the `github.com/moov-io/signedxml` package and upgrade to version 1.4.1 or later.
• Assess exposure to this vulnerability, particularly if using SAML / WS-Federation service providers that rely on this library.
• Implement compensating controls, such as monitoring and exception tracking, to detect potential attacks.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was verified in version 1.4.0 and the current default branch (commit d79064a) of the `github.com/moov-io/signedxml` package. Earlier versions 1.2.x–1.3.x are likely affected. The remediation involves not copying the whole namespace map per node and maintaining a single scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.