CVE-2011-2516: Apache XML Security For C++

Medium severity, CVSS 5.0. EPSS: 7.7% chance of exploitation in the next 30 days.

Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.

Affected products

• Apache XML Security For C++: version 1.6.0 only
• Shibboleth Shibboleth-SP: up to and including 2.4.2; version 1.3.1 only; version 1.3.2 only; version 1.3.3 only; version 1.3.4 only; version 1.3.5 only; …

Published 2011-07-11. Last modified 2026-06-16.