← CVE Intelligence

CVE-2026-4598

n/a / jsrsasign PUBLISHED

Description (CNA)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Affected (CNA)

Vendor / productVersions
n/a / jsrsasignaffected 0 before 11.1.1
n/a / org.webjars.npm:jsrsasignaffected 0 before *

CWE

CWE-835

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in jsrsasign. A remote attacker could exploit this vulnerability by providing specially crafted zero or negative inputs to the bnModInverse function within the BigInteger.modInverse implementation. This could lead to an infinite loop, causing a permanent denial of service (DoS) by hanging the process.