CVE-2025-40934 Details
Description
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
A vulnerability exists in XML-Sig versions 0.27 to 0.67 for Perl, where the module improperly validates XML files in the absence of signatures. This flaw allows an attacker to remove the signature from an XML document, enabling it to pass verification checks. Normally, an unsigned XML file should trigger an error, but the affected versions incorrectly validate such files as signed.
Users can upgrade to XML-Sig version 0.68 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/perl-net-saml2/perl-XML-Sig/issues/63 | CPANSec | Issue TrackingPatch |
| https://github.com/perl-net-saml2/perl-XML-Sig/pull/64 | CPANSec | Issue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| xml::sig project xml::sig | >= 0.27, <= 0.67 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 30, 2025 | Initial Analysis | [email protected] |
| Nov 28, 2025 | CVE Modified | CISA-ADP |
| Nov 26, 2025 | New CVE Received | CPANSec |