Vulnerability in Timlegge Xml::sig
CVE-2025-40934
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
EPSS: 0.002 (5.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N.
Affected products
- Timlegge Xml::sig — versions 0.27
- Xml\ \ — versions sig_project
- Xml\:\:sig_project Xml\:\:sig
Weakness classification (CWE)
References
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (issue-tracking, Patch, Issue Tracking)
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (patch, Issue Tracking)
Frequently asked questions
- What is CVE-2025-40934?
- CVE-2025-40934 is a critical-severity vulnerability in Timlegge Xml::sig, classified under Improper Verification of Cryptographic Signature. CVSS score: 9.3/10. Published 2025-11-26.
- How severe is CVE-2025-40934?
- Critical severity. CVSS v3 base score is 9.3 out of 10.