Skip to content

CBC Padding Oracle via Unvalidated ISO 10126 Unpadding Enables Decryption of Encrypted XML Content

Moderate
robrichards published GHSA-7h47-29x2-r2gc Aug 24, 2026

Package

composer robrichards/xmlseclibs (Composer)

Affected versions

< 4.0.0

Patched versions

4.0.0

Description

Summary

Symmetric CBC decryption used ISO 10126 unpadding without validating pad length and surfaced distinguishable errors on failure, enabling a padding oracle against encrypted XML content.

Details

unpadISO10126() validates pad length against block size. All symmetric and asymmetric decryption failures are normalized to a single generic Failure decrypting Data exception so callers cannot distinguish padding errors from other failures.

Upgrade / mitigation

  • Upgrade to 4.0.0+.
  • Pin data algorithms to GCM via $objenc->allowedDataAlgorithms = XMLSecEnc::DEFAULT_DATA_ALGORITHMS.

Users of xmlseclibs in SAML, WS-Security, or other XML signature/encryption flows should upgrade to 4.0.0 or later. Review the 4.0 migration notes in CHANGELOG.txt and README.md. Prefer verifyDocument() with a pinned trusted key and XMLSecEnc algorithm allowlists (DEFAULT_KEY_ALGORITHMS, DEFAULT_DATA_ALGORITHMS). Use enableLegacyMode() only temporarily while migrating legacy peers.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. Learn more on MITRE.

Credits