Vulnerabilities for signxml

First version without a known vulnerability: 4.0.4

Details

• GHSA-6vx8-pcwv-xhf42025-06-05

  SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

  Fixed in: 4.0.4

• GHSA-gmhf-gg8w-jw422025-06-05

  SignXML's signature verification with HMAC is vulnerable to a timing attack

  Fixed in: 4.0.4