PT-2026-25372 · Packagist+3 · Robrichards/Xmlseclibs+1

Sideni · Published 2026-03-13 · Updated 2026-03-16 · CVE-2026-32313

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions xmlseclibs versions prior to 3.1.5

Description xmlseclibs is a PHP library used for working with XML Encryption and Signatures. A flaw exists in how XML nodes encrypted with aes-128-gcm, aes-192-gcm, or aes-256-gcm handle authentication tag length validation. Specifically, the length of the authentication tag is not validated during decryption, allowing an attacker to potentially brute-force the tag, recover the GHASH key, and decrypt the encrypted nodes. This also enables the forging of arbitrary ciphertexts without knowledge of the encryption key. The GHASH key is a string of bits used in Galois/Counter Mode (GCM) to ensure the integrity and authenticity of the ciphertext. Exploitation involves manipulating the ciphertext and observing XML parsing errors to recover the key.

Recommendations Versions prior to 3.1.5 should be updated to version 3.1.5 or later.

Exploit

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2026-32313

GHSA-4V26-V6CG-G6F9

Affected Products

Robrichards/Xmlseclibs

Xmlseclibs

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32313.json · Exploit
• https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-4v26-v6cg-g6f9 · Vendor Advisory
• https://github.com/robrichards/xmlseclibs/commit/03062be78178cbb5e8f605cd255dc32a14981f92 · Patch
• https://osv.dev/vulnerability/GHSA-4v26-v6cg-g6f9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32313 · Security Note
• https://github.com/robrichards/xmlseclibs · Note
• https://github.com/robrichards/xmlseclibs/releases/tag/3.1.5 · Note
• https://twitter.com/CVEnew/status/2032605880173138072 · Twitter Post