CVE-2025-40934
XML-Sig prior to 0.68 for Perl improperly validates XML without signatures
Reported by cpansec · Published November 26, 2025
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| XML-Sig | cpan.org | 0.68 |
| perl-xml-sig | Alpine | 0.68-r0 |
| \ | xml\ | 0.67 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| TIMLEGGE | XML::Sig | 0.27 |
| TIMLEGGE | XML::Sig | 0.27 |
| alpine | perl-xml-sig | 0 |
Timeline
- Nov 26, 2025 Fix PR Merged
- Nov 26, 2025 CVE Published
- Nov 27, 2025 EPSS Score (30 in total, the first dated here)
- Nov 27, 2025 Coalition ESS Score (5 in total, the first dated here)
- Nov 28, 2025 CVE Updated
- Apr 1, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-40934
vulnetix vdb fixes CVE-2025-40934Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-40934/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart