PatchTheCVECVE-2026-18568: XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns tr
37
Routine
HIGH 7.5REMOTEUPGRADE
CVE-2026-18568 is a high-severity flaw (CVSS 7.5) affecting \. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the `//dsig:Signature` elements into `$numsigs` and iterates over them, but two paths reach `next` before any digest or key check runs: a `SignedInfo/Reference/@URI` that resolves to no element while `$numsigs` is greater than 1, and, when
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 76%) |
| CISA exploited list | No |
| Weakness | CWE-347 |
| Published | 2026-08-03 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
xml\ \ UPGRADE
Affected: >= 0.29 and < 0.72
Fixed in: 0.72
Safe to downgrade to: a release before 0.29
1. Check installed version
apt-cache policy || rpm -q || --version
2. UPGRADE to 0.72 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.29 (Debian / Ubuntu)
apt-cache madison
sudo apt install =<VERSION_BEFORE_0.29>
sudo apt-mark hold
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list
sudo dnf downgrade -<VERSION_BEFORE_0.29>
sudo dnf versionlock add
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-9390 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in
- CVE-2026-9487 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XM