github.com/russellhaering/goxmldsig (Go)
Pure Go implementation of XML Digital Signatures
Advisories
12
Latest version
v1.6.1
Released Aug 4, 2026
License
Apache-2.0
OpenSSF Scorecard
7.2 / 10
How to fix
Upgrading to 1.6.0 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/russellhaering/goxmldsig@v1.6.1 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-479m-364c-43vc validateSignature Loop Variable Capture Signature Bypass in goxmldsig |
High EPSS 0.32% |
< 1.6.0 | 1.6.0 |
| GHSA-479m-364c-43vc validateSignature Loop Variable Capture Signature Bypass in goxmldsig |
High EPSS 0.32% |
< 1.6.0 | 1.6.0 |
| GHSA-479m-364c-43vc validateSignature Loop Variable Capture Signature Bypass in goxmldsig |
High EPSS 0.32% |
<= 1.5.0 | No fix yet |
| GO-2022-0409 An attacker can create an XML file which completely bypasses signature validation, passing off an altered file as a signed one. Withdrawn |
Not rated yet | < 1.1.0 | 1.1.0 |
| GHSA-rrfw-hg9m-j47h Signature Validation Bypass |
Critical | < 0.4.2 | 0.4.2 |
| GHSA-mqqv-chpx-vq25 Duplicate Advisory: gosaml2 is vulnerable to NULL Pointer Dereference from malformed XML signatures |
High EPSS 1.80% |
< 1.1.1 | 1.1.1 |
| GHSA-mqqv-chpx-vq25 Duplicate Advisory: gosaml2 is vulnerable to NULL Pointer Dereference from malformed XML signatures |
High EPSS 1.80% |
< 1.1.1 | 1.1.1 |
| GHSA-q547-gmf8-8jr7 github.com/russellhaering/goxmldsig vulnerable to Signature Validation Bypass |
Medium EPSS 1.72% |
< 1.1.0 | 1.1.0 |
| GHSA-mqqv-chpx-vq25 Duplicate Advisory: gosaml2 is vulnerable to NULL Pointer Dereference from malformed XML signatures |
High EPSS 1.80% |
< 1.1.1 | 1.1.1 |
| GHSA-mqqv-chpx-vq25 Duplicate Advisory: gosaml2 is vulnerable to NULL Pointer Dereference from malformed XML signatures |
High EPSS 1.80% |
< 1.1.1 | 1.1.1 |
| GHSA-q547-gmf8-8jr7 github.com/russellhaering/goxmldsig vulnerable to Signature Validation Bypass |
Medium EPSS 1.72% |
< 1.1.0 | 1.1.0 |
| GHSA-m9hp-7r99-94h5 Authentication Bypass in dex |
Critical EPSS 1.72% |
< 1.1.0 | 1.1.0 |
Source: https://github.com/russellhaering/goxmldsig
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor