PyPI/signxml CVE-2025-48995: medium 6.9, EPSS 0.24%

SignXML's signature verification with HMAC is vulnerable to a timing attack

Action: Upgrade signxml to 4.0.4 or later.

pip install signxml==4.0.4

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1922
• nvd: CVE-2025-48995
• https://github.com/XML-Security/signxml/security/advisories/GHSA-gmhf-gg8w-jw42
• https://github.com/XML-Security/signxml/commit/1b501faaacf34cf978a52dbc6915ec11e27611cd
• https://github.com/XML-Security/signxml
• https://pypi.org/project/signxml
• https://github.com/advisories/GHSA-gmhf-gg8w-jw42

CVE-2025-48995 · published 2026-07-07T16:02:53.797116Z · modified 2026-07-07T17:48:12.603963915Z · JSON