Moov signedxml allows an attacker to craft an XML document with extremely deep nesting and many unused namespaces. When the library processes the document, it copies the entire namespace map at each element, causing quadratic allocation growth in document depth and linear growth with the number of prefixes. This can consume multiple gigabytes of memory and terminate the process, leading to a denial of service. The flaw is independent of signatures; it can be triggered without any authentication or signature verification, though it does not affect signature validation itself.

The vulnerability affects any application that incorporates the moov-io signedxml library before version 1.4.1. This includes all releases of the library older than 1.4.1, as documented by the vendor. No specific system components are mentioned beyond the library itself.

The CVSS score is 7.5, indicating a high impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw simply by sending a specially crafted XML payload to a service that uses the library; no signature, certificate, or prior authentication is required. Because the denial of service can be achieved with modest resource consumption, the risk is significant for exposed services or those that parse user supplied XML.