Improper Verification of Cryptographic Signature Affecting dex package, versions <2.45.1-r2

Note: Versions mentioned in the description apply only to the upstream dex package and not the dex package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the validateSignature function in validate.go goes through the references in the SignedInfo block to find one that matches the signed element's ID. In Go versions before 1.22, or when go.mod uses an older version, there is a loop variable capture issue. The code takes the address of the loop variable _ref instead of its value. As a result, if more than one reference matches the ID or if the loop logic is incorrect, the ref pointer will always end up pointing to the last element in the SignedInfo.References slice after the loop. goxmlsig version 1.6.0 contains a patch.

• https://www.cve.org/CVERecord?id=CVE-2026-33487
• https://github.com/advisories/GHSA-479m-364c-43vc
• https://osv.dev/vulnerability/MINI-mrgc-367w-wx2x
• https://osv.dev/vulnerability/CVE-2026-33487
• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc