CVE-2025-66578
1 advisory.
Packagist/robrichards/xmlseclibs CVE-2025-66578: medium 6, EPSS 0.24%
robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation
Action: Upgrade robrichards/xmlseclibs to 3.1.4 or later.
composer require robrichards/xmlseclibs:3.1.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.1.4 | - |
Fixed versions
| 3.1.4 |
Sources
- osv: GHSA-c4cc-x928-vjw9
- https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-c4cc-x928-vjw9
- https://nvd.nist.gov/vuln/detail/CVE-2025-66578
- https://github.com/robrichards/xmlseclibs/commit/69fd63080bc47a8d51bc101c30b7cb756862d1d6
- https://github.com/robrichards/xmlseclibs
- https://github.com/robrichards/xmlseclibs/blob/f4131320c6dcd460f1b0c67f16f8bf24ce4b5c3e/src/XMLSecurityDSig.php#L296
CVE-2025-66578 · published · modified · JSON