CVE-2026-4598

HIGH EPSS 31.9%
Published Mar 23, 20263mo ago · Modified Jun 22, 20261w ago
7.7 CVSS 4.0
High
Find Similar
Published Mar 23, 2026 3mo ago
Last Modified Jun 22, 2026 1w ago

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

CVSS Details

Base Score
7.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
31.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-835

Affected Products 1

VendorProductVersionRange
kjurjsrsasign* <11.1.1

References 4

  • gist.github.com https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
    ExploitMitigationThird Party Advisory
  • github.com https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
    Patch
  • github.com https://github.com/kjur/jsrsasign/pull/648
    Issue Tracking
  • security.snyk.io https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
    Third Party Advisory

Remediation

  • github.com https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
    Patch