PatchSiren

moov-io CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH moov-io CVE published 2026-10-21

CVE-2026-113729

CVE-2026-113729 is a denial-of-service vulnerability in the `github.com/moov-io/signedxml` package. The vulnerability arises from the `ExclusiveCanonicalization` function's inefficient handling of namespace maps during XML canonicalization, which can lead to multi-gigabyte allocations and cause the process to run out of memory (OOM). This issue affects SAML / WS-Federation service providers that use this [truncated]