CVE-2025-48995: SignXML HMAC Signature Verification Timing Attack Vulnerability
Summary
CVE-2025-48995: SignXML's signature verification with HMAC is vulnerable to a timing attack. Affects signxml versions < 4.0.4. Fixed in 4.0.4. How to fix ↓
Also tracked for
- python-signxml · Debian:13
The same CVE-2025-48995 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SignXML is a Python library designed for creating and verifying XML signatures. It supports various signature algorithms and is widely used in applications that require secure XML data transmission. However, prior versions of SignXML have a vulnerability that can be exploited when HMAC shared secret verification is enabled without X509 certificate validation, making it susceptible to timing attacks.
Vulnerability Detail
The vulnerability arises when the signature verification process is executed with the X509 certificate validation turned off and the HMAC shared secret is set. In this scenario, the signature verifier may inadvertently leak information about the correct HMAC through timing discrepancies when comparing the user-supplied hash with the correct one. This leakage allows an attacker to potentially reconstruct the correct HMAC for any given data, posing a significant security risk.
How To Fix
Latest published version: 5.2.0 as of 23 Oct 2026
pip install --upgrade "signxml==5.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.4
This is the first release that contains the fix.
pip install --upgrade "signxml==4.0.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can enable X509 certificate validation by setting 'require_x509=True' in the signature verification process. This will help mitigate the risk of timing attacks until you can update to the patched version.
Conclusion
The timing attack vulnerability in SignXML's HMAC signature verification poses a moderate security risk, allowing attackers to potentially reconstruct valid HMACs. It is crucial to update to version 4.0.4 or later to mitigate this risk. For immediate protection, enabling X509 certificate validation is recommended.
See every vulnerability recorded for signxml →
FAQ
A timing attack is a type of side-channel attack where an attacker gains information about the execution time of a cryptographic operation to infer sensitive data, such as cryptographic keys or HMACs.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can allow an attacker to reconstruct the correct HMAC for any data, potentially leading to unauthorized access or data manipulation.
Yes, version 4.0.4 and later of SignXML includes a fix for this vulnerability and is safe to use.
If you cannot update the package right away, consider enabling X509 certificate validation as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for signxml.
