PatchTheCVECVE-2026-9487: XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XM
45
This month
CRITICAL 9.1REMOTEUPGRADE
CVE-2026-9487 is a critical-severity flaw (CVSS 9.1) affecting \. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, an
Why this priority
- Critical severity
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 81%) |
| CISA exploited list | No |
| Weakness | CWE-347 |
| Published | 2026-08-03 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
xml\ \ UPGRADE
Affected: < 0.71
Fixed in: 0.71
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy || rpm -q || --version
2. UPGRADE to 0.71 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Exact fixes by distribution
Fedora 46 · kwin-zones · FIXED · 1.0.13-1.fc46 · FEDORA-2026-95888f332b · source
sudo dnf upgrade --advisory=FEDORA-2026-95888f332b
Fedora ELN · nginx-mod-brotli · FIXED · 1.0.0~rc-16.eln159 · FEDORA-2026-501a6a8273 · source
sudo dnf upgrade --advisory=FEDORA-2026-501a6a8273
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-9390 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in
- CVE-2026-18568 HIGH 7.5 UPGRADE XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns tr