CVE-2026-33487: goxmlsig XXE Vulnerability

CVE-2026-33487 Overview

CVE-2026-33487 is a Improper Verification of Cryptographic Signature vulnerability affecting goxmldsig, a Go library that provides XML Digital Signatures implementation. The vulnerability exists in the validateSignature function within validate.go, where a loop variable capture issue can cause signature validation to reference incorrect elements in the SignedInfo.References slice.

This flaw specifically affects Go versions prior to 1.22, or when the project's go.mod specifies an older Go version. Due to the loop variable capture behavior in older Go versions, the code takes the address of the loop variable _ref instead of its value, causing the ref pointer to always point to the last element in the SignedInfo.References slice after the loop completes.

Critical Impact

Attackers could potentially bypass XML digital signature validation, leading to signature forgery or acceptance of improperly signed XML documents with high integrity impact.

Affected Products

• goxmldsig versions prior to 1.6.0
• Applications using Go versions prior to 1.22 with affected goxmldsig versions
• Projects with go.mod specifying older Go versions even when compiled with Go 1.22+

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-33487 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33487

Vulnerability Analysis

This vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature). The root issue lies in how Go handles loop variable scoping in versions prior to 1.22. When the validateSignature function iterates through references in the SignedInfo block to find a match for the signed element's ID, it captures the address of the loop variable rather than its value.

In practical terms, this means that if multiple references match the ID or if specific loop logic conditions occur, the reference pointer will incorrectly point to the last element in the SignedInfo.References slice regardless of which reference actually matched. This behavior can lead to signature validation operating on the wrong reference element, potentially allowing signature bypass attacks.

The vulnerability has network-based attack vectors requiring no privileges or user interaction, making it exploitable remotely against applications processing XML digital signatures.

Root Cause

The root cause is the Go loop variable capture behavior in versions prior to 1.22. In older Go versions, when a loop variable's address is taken (using & operator), all iterations share the same memory address for that variable. After the loop completes, this address contains only the value from the final iteration. The vulnerable code pattern in validateSignature takes &_ref during iteration, causing the captured reference to always be the last one in the slice, regardless of which reference actually matched the signed element's ID.

Attack Vector

The vulnerability can be exploited through the network by submitting specially crafted XML documents with digital signatures to applications using vulnerable versions of goxmldsig. An attacker could construct XML documents where the signature validation logic references an incorrect element due to the loop variable capture issue. This could enable:

1. Signature Bypass: Crafting documents where the signature appears valid but covers different content than intended
2. Reference Manipulation: Exploiting scenarios with multiple matching references to cause validation against unintended data
3. Integrity Compromise: Modifying signed content while maintaining apparent signature validity

The vulnerability manifests in the signature validation function when processing the SignedInfo.References slice. For detailed technical analysis and proof-of-concept patterns, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33487

Indicators of Compromise

• Unexpected XML signature validation successes in application logs
• Discrepancies between signed content and validated references in audit trails
• Applications accepting XML documents with signatures that should have failed validation

Detection Strategies

• Review application dependencies for goxmldsig versions prior to 1.6.0
• Audit go.mod files to identify projects specifying Go versions older than 1.22
• Implement logging around XML signature validation to detect anomalous acceptance patterns
• Use software composition analysis (SCA) tools to identify vulnerable library versions

Monitoring Recommendations

• Enable verbose logging for XML signature validation operations
• Monitor for unusual patterns in signature verification, particularly documents with multiple references
• Implement integrity checks comparing expected vs. actual validated content
• Set up alerts for signature validation on documents with complex SignedInfo.References structures

How to Mitigate CVE-2026-33487

Immediate Actions Required

• Upgrade goxmldsig to version 1.6.0 or later immediately
• Update go.mod to specify Go version 1.22 or later
• Recompile applications using Go 1.22+ to benefit from the corrected loop variable scoping
• Audit any XML documents processed during the vulnerable period for integrity

Patch Information

The vulnerability has been addressed in goxmldsig version 1.6.0. The patch corrects the loop variable capture issue by ensuring proper value capture instead of address capture during reference iteration. Organizations should upgrade to version 1.6.0 or later as documented in the GitHub Security Advisory.

Workarounds

• Upgrade to Go 1.22 or later and rebuild applications, as the new Go runtime fixes loop variable scoping behavior at the language level
• Update go.mod to require Go 1.22 minimum version before rebuilding
• If immediate upgrade is not possible, implement additional validation layers for XML signatures outside of goxmldsig
• Consider restricting XML documents to single-reference signatures until patched

# Configuration example
# Upgrade goxmldsig to patched version
go get github.com/russellhaering/goxmldsig@v1.6.0

# Update go.mod to require Go 1.22+
go mod edit -go=1.22

# Rebuild application with updated dependencies
go build -o myapp ./...

# Verify the dependency version
go list -m github.com/russellhaering/goxmldsig