CVE-2026-32313: robrichards xmlseclibs

Vulnerability summary

CVE-2026-32313 is a high (CVSS 8.2) vulnerability in robrichards xmlseclibs. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-03-2026
   PublishedVulnerability first disclosed.
2. 16-03-2026
   Last modifiedVulnerability information updated.

Description

xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Prior to 3.1.5, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can use this to brute-force an authentication tag, recover the GHASH key, and decrypt the encrypted nodes. It also allows to forge arbitrary ciphertexts without knowing the encryption key. This vulnerability is fixed in 3.1.5.

• CWE-354Improper Validation of Integrity Check ValueThe product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.