CVE-2026-4599

CRITICAL EPSS 26.4%
Published Mar 23, 20263mo ago · Modified Jun 22, 20261w ago
9.3 CVSS 4.0
Critical
Find Similar
Published Mar 23, 2026 3mo ago
Last Modified Jun 22, 2026 1w ago

Description

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.

CVSS Details

Base Score
9.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
26.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-1023

Affected Products 1

VendorProductVersionRange
kjurjsrsasign*≥7.0.0  –  <11.1.1

References 4

  • gist.github.com https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
    ExploitMitigationThird Party Advisory
  • github.com https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
    Patch
  • github.com https://github.com/kjur/jsrsasign/pull/647
    Issue Tracking
  • security.snyk.io https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939
    Third Party Advisory

Remediation

  • github.com https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
    Patch