https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T23:55:52.559554+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-183236 EUVD-2026-183236 2026-10-06T23:55:52.563843+00:00 EUVD-2026-183236 https://cve.radiocsirt.org/vuln/fkie_cve-2020-7731 fkie_cve-2020-7731 2026-10-06T23:55:52.563901+00:00

This affects all versions <0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.

 https://cve.radiocsirt.org/vuln/ghsa-prjq-f4q3-fvfr GHSA-prjq-f4q3-fvfr — github.com/russellhaering/gosaml2 is vulnerable to NULL Pointer Dereference 2026-10-06T23:55:52.563951+00:00

Affected: Go: github.com/russellhaering/gosaml2, Go: github.com/russellhaering/goxmldsig

### Impact In versions prior to v0.7.0 it was possible for an attacker to supply an invalid assertion which would trigger a panic due to a nil-pointer dereference.

### Patches The issue was patched in v0.7.0, released on March 2, 2022.

### Workarounds Callers to `gosaml2` can use `recover()` to handle panics to mitigate a potential DoS.

### References See issue [#59](https://github.com/russellhaering/gosaml2/issues/59) for details.

 https://cve.radiocsirt.org/vuln/gsd-2020-7731 gsd-2020-7731 2026-10-06T23:55:52.563981+00:00 gsd-2020-7731