goxmldsig has validateSignature Loop Variable Capture Signature Bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-33487 · CVE overview and exploitation status

EUVD-2026-16281

GHSA-479m-364c-43vc

GO-2026-4753

cve-program · CVE-2026-33487

• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc

euvd · EUVD-2026-16281

• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc

nvd · CVE-2026-33487

• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc
• https://access.redhat.com/errata/RHSA-2026:13548
• https://access.redhat.com/errata/RHSA-2026:20943
• https://access.redhat.com/errata/RHSA-2026:20946
• https://access.redhat.com/errata/RHSA-2026:21769
• https://access.redhat.com/errata/RHSA-2026:22347
• https://access.redhat.com/errata/RHSA-2026:22423
• https://access.redhat.com/errata/RHSA-2026:23345
• https://access.redhat.com/errata/RHSA-2026:36882
• https://access.redhat.com/security/cve/CVE-2026-33487
• https://bugzilla.redhat.com/show_bug.cgi?id=2451814
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33487.json

osv · GHSA-479m-364c-43vc

• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc
• https://nvd.nist.gov/vuln/detail/CVE-2026-33487
• https://github.com/russellhaering/goxmldsig

osv · GO-2026-4753

• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc

No related changes are available here.