Orgs hit by DoS: moov-io signedxml 1.4.1 fixes CVE-2026-113729 XML memory crash
A high-severity flaw in the moov-io/signedxml Go library allows attackers to crash processes with small XML files. Version 1.4.1 patches the issue.
Key points
- CVE-2026-113729 affects moov-io/signedxml versions up to 1.4.0.
- The flaw causes unbounded memory allocation during XML canonicalization.
- Version 1.4.1 resolves the issue by optimizing namespace handling.
The moov-io/signedxml Go library contains a high-severity vulnerability, tracked as CVE-2026-113729, that enables remote attackers to exhaust process memory. This flaw impacts versions up to and including 1.4.0. A patched version, 1.4.1, has been released to address the issue. The vulnerability exists in the exclusive XML canonicalization function used for validating signatures.
How it unfolded
- The vulnerability was identified in the ExclusiveCanonicalization function within exclusivecanonicalization.go.
- Researchers found that the function copied the entire namespace map at every node during validation.
- This behavior occurred before any reference digest or signature checks were performed.
Who is affected
Systems using github.com/moov-io/signedxml version 1.4.0 or the current default branch are directly affected. Earlier releases from the v1.2.x and v1.3.x series are likely vulnerable as well. The flaw impacts the core path for SAML and WS-Federation service providers. These systems canonicalize attacker-supplied XML prior to authentication, making them prime targets for this specific denial-of-service vector.
Our take on the response
The fix in version 1.4.1 changes how the library handles namespace scopes. Instead of copying the whole map per node, it now maintains a single scope and pushes or pops only prefixes introduced at each element. This optimization replaces linear scans with set lookups and imposes a defensive cap on in-scope declarations. The update prevents unbounded memory allocation while preserving valid signature verification.
Who needs to act first
Teams should prioritize updating systems that process untrusted XML from external users, such as public-facing SAML endpoints. Before deploying the patch, test it in a staging environment to ensure compatibility with existing authentication flows. Back up configuration files and application code to allow for quick rollback if issues arise. Monitor resource usage closely during the update to detect any unexpected behavior early.
Background: SAML
Security Assertion Markup Language reduces risk by eliminating password storage across multiple vendors. Instead of creating credentials for every application, users authenticate once with a trusted identity provider, which issues cryptographic signed tokens to grant access without sharing raw secrets.
Read the full guide: Why is SAML more secure than traditional password login
What to do and how to stay safe: moov-io
- Update github.com/moov-io/signedxml to version 1.4.1 or later in all production environments.
- Verify that all dependent services are restarted to load the patched library code.
- Monitor application logs for out-of-memory errors or unusual CPU spikes after deployment.
- Review firewall rules to limit XML payload sizes if immediate patching is not feasible.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS severity of CVE-2026-113729?
The vulnerability is rated as high severity according to the GitHub advisory.
Does this flaw require authentication to exploit?
No, the source material states that no valid signature, matching certificate, or authentication is required.
Which specific function is vulnerable?
The ExclusiveCanonicalization function in exclusivecanonicalization.go is the vulnerable component.
