CVE-2026-32313
xmlseclibs is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
HIGH 8.2
At a glance
- Source
- NVD
- EPSS
- EPSS 0.16 % · percentile 5 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Prior to 3.1.5, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can use this to brute-force an authentication tag, recover the GHASH key, and decrypt the encrypted nodes. It also allows to forge arbitrary ciphertexts without knowing the encryption key. This vulnerability is fixed in 3.1.5.
Weaknesses (CWE)
- CWE-354 — Improper Validation of Integrity Check Value
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | GitHub_M |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-4v26-v6cg-g6f9 — xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
European references
- ENISA EUVD · EUVD-2026-12094
- GCVE · GCVE-0-2026-32313
Affected configurations (NVD CPE)
cpe:2.3:a:xmlseclibs_project:xmlseclibs:*:*:*:*:*:*:*:*< 3.1.5
Affected products
| Product | Versions |
|---|---|
| robrichards · xmlseclibs | affected < 3.1.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |