CVE-2026-113729
Description
A flaw was found in signedxml. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by sending a specially crafted XML document containing deeply nested elements with numerous namespace declarations. During canonicalization, the library excessively copies namespace data before verifying signatures or digests, resulting in high memory consumption that can terminate the application process.
Statement
This vulnerability is rated as Important severity because unauthenticated remote attackers can trigger an out-of-memory condition to crash consuming services, with no prior privileges or valid cryptographic signatures required. Applications implementing XML digital signature validation—such as SAML identity providers or federation endpoints—process untrusted documents through canonicalization prior to verifying signatures, exposing the service to resource exhaustion. The ability to induce an unrecoverable process crash via modest network payloads justifies the Important rating over a lower classification.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
