CVE-2025-48995 json
SignXML's signature verification with HMAC is vulnerable to a timing attack
published 2025-06-02 17 mo ago modified 2026-07-07 4 mo ago also GHSA-gmhf-gg8w-jw42 , PYSEC-2026-1922 , EUVD-2025-16676
- cvss
- 6.9
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing it with the user supplied hash, allowing users to reconstruct the correct HMAC for any data.
Patch / fix
- pypi signxml 4.0.4
- python-signxml Debian 14, Debian 13 4.0.5+dfsg-1
debian advisories DEBIAN-CVE-2025-48995
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | signxml | <4.0.4 |
4.0.4 |
Affected products
- XML-Security signxml
Classification
- Weakness
-
- CWE-208 Observable Timing Discrepancy
References
-
github.com
/XML-Security/signxml/commit/1b501faaacf34cf978a52dbc6915ec11e27611cd
web
-
github.com
/XML-Security/signxml/security/advisories/GHSA-gmhf-gg8w-jw42
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-48995
advisory
-
github.com
/XML-Security/signxml
package
-
pypi.org
/project/signxml
package
-
github.com
/advisories/GHSA-gmhf-gg8w-jw42
advisory
Sources
- CVE List CVE-2025-48995
- GitHub Advisory GHSA-gmhf-gg8w-jw42
- NVD CVE-2025-48995
- OSV PYSEC-2026-1922
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.