CVE-2026-32313 - Vulnerability Analysis

Overview

xmlseclibs prior to 3.1.5 contains a cryptographic vulnerability caused by lack of authentication tag length validation in AES-GCM encrypted XML nodes, letting attackers forge ciphertexts and decrypt nodes, exploit requires crafted encrypted XML nodes.

Severity & Score

Impact

Attackers can decrypt encrypted XML nodes and forge ciphertexts without the encryption key, compromising confidentiality and integrity.

Mitigation

Update to version 3.1.5 or later.

References

• https://github.com/robrichards/xmlseclibs/commit/03062be78178cbb5e8f605cd255dc32a14981f92
• https://github.com/robrichards/xmlseclibs/releases/tag/3.1.5
• https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-4v26-v6cg-g6f9

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 16, 2026

🟠 CVE-2026-32313 - High (8.2) xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Prior to 3.1.5, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can use t... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32313/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner