What is CVE-2026-9487?
CVE-2026-9487 is a signature wrapping vulnerability in the XML::Sig Perl module before version 0.71. It occurs because the `_get_signed_xml()` method, used by `verify()`, returns only the first node matching an ID, allowing bypass via duplicate IDs. Upgrade XML::Sig to version 0.71 or later.
Azərbaycanca: CVE-2026-9487 Perl-in XML::Sig modulunda (0.71-dən əvvəlki versiyalarda) imza əhatələmə (signature wrapping) zəifliyidir. Bu, dublikat ID-lər vasitəsilə `verify()` funksiyasında `_get_signed_xml()` metodunun yalnız ilk nodu qaytarması səbəbindən baş verir. XML::Sig-i ən az 0.71 versiyasına yeniləmək tövsiyə olunur.
FAQ1
How is CVE-2026-9487 exploited in the XML::Sig Perl module?
A signature wrapping attack is performed by inserting duplicate IDs into the XML. Since the `_get_signed_xml()` method used by `verify()` returns only the first matching node, an attacker can bypass signature verification by tricking the process into validating a manipulated node instead of the originally signed content.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.