Vulnerability Description
xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can use this to brute-force an authentication tag, recover the GHASH key, and decrypt the encrypted nodes. It also allows to forge arbitrary ciphertexts without knowing the encryption key. This vulnerability is fixed in 2.3.1 and 1.13.9.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Simplesamlphp | Xml-Security | < 1.13.9 |
Related Weaknesses (CWE)
References
- https://github.com/simplesamlphp/xml-security/commit/cad6d57cf0a5a0b7e0cc4e4a5b1Patch
- https://github.com/simplesamlphp/xml-security/commit/fdc12449e959c610943f9fd428ePatch
- https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-r353-4845ExploitVendor Advisory
FAQ
What is CVE-2026-32600?
CVE-2026-32600 is a vulnerability with a CVSS score of 8.2 (HIGH). xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of...
How severe is CVE-2026-32600?
CVE-2026-32600 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-32600?
Check the references section above for vendor advisories and patch information. Affected products include: Simplesamlphp Xml-Security.