GoPackage

github.com/russellhaering/goxmldsig

6 known vulnerabilities (1 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-33487
Affects v1.1.0 to v1.5.0 (v1.6.0 is outside it)
CVE-2020-27847
No published release is affected
No published release is affected
CVE-2020-7731
Affects v1.1.0 (v1.1.1 is outside it)
CVE-2020-26290
No published release is affected
No published release is affected
CVE-2020-15216
No published release is affected
No published release is affected
CVE-2020-7711
Affects v1.1.0 (v1.1.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-33487High 7.5
goxmldsig has validateSignature Loop Variable Capture Signature Bypass
Affected: fixed in 1.6.0.
Fixed in v1.6.0 (released Mar 18, 2026, 8 days before disclosure).
The latest release, v1.6.1, is not affected.
CVE-2020-27847Unrated
A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation.
Affected: fixed in 1.1.0.
Fixed in v1.1.0 (released Sep 29, 2020, 241 days before disclosure).
The latest release, v1.6.1, is not affected.
CVE-2020-7731High 7.5
Denial of Service (DoS)
Affected: fixed in 1.1.1.
Fixed in v1.1.1 (released Aug 28, 2021, 120 days after disclosure).
The latest release, v1.6.1, is not affected.
CVE-2020-26290Critical 9.3
Critical security issues in XML encoding in Dex
Affected: fixed in 1.1.0.
Fixed in v1.1.0 (released Sep 29, 2020, 90 days before disclosure).
The latest release, v1.6.1, is not affected.
CVE-2020-15216Medium 5.3
Signature Validation Bypass in goxmldsig
Affected: fixed in 1.1.0.
Fixed in v1.1.0 (released Sep 29, 2020, the day of disclosure).
The latest release, v1.6.1, is not affected.
CVE-2020-7711High 7.5
Denial of Service (DoS)
Affected: fixed in 1.1.1.
Fixed in v1.1.1 (released Aug 28, 2021, 370 days after disclosure).
The latest release, v1.6.1, is not affected.