What is CVE-2026-18568?
CVE-2026-18568 is a signature verification bypass vulnerability in XML::Sig for Perl versions 0.29 to 0.72. The `verify` function returns true when every signature is skipped before any cryptographic check, allowing attackers to bypass security validation. Users should upgrade to version 0.72 or higher.
Azərbaycanca: CVE-2026-18568 Perl-in XML::Sig modulunda (0.29-dan 0.72-yə qədər versiyalarda) imza doğrulama bypass zəifliyidir. `verify` funksiyası kriptoqrafik yoxlamadan əvvəl bütün imzalar atlandıqda səhvən "doğru" qaytarır, bu da təhlükəsizlik yoxlamasının yan keçilməsinə səbəb olur. XML::Sig istifadəçiləri modulu 0.72 və ya daha yüksək versiyaya yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-287
FAQ2
Which component does CVE-2026-18568 affect and what is its root cause?
This vulnerability affects the XML::Sig module for Perl from versions 0.29 to 0.72. The root cause is that the `verify` function incorrectly returns true when every signature is skipped before any cryptographic check.
What action should be taken to remediate CVE-2026-18568?
XML::Sig users should upgrade the module to version 0.72 or higher.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.