High severity · published Mar 23, 2026
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
jsrsasign ·
before 11.1.1 · source: vendor, NVD
OR
org.webjars.npm:jsrsasign ·
0 · source: vendor
MT
Migration Toolkit for Virtualization 2.1 · Red Hat
All versions, or not specified · source: CISA
MT
Migration Toolkit for Virtualization 2.9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.12 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.15 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.16 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.9 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4598
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4598
Exploit
https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
Patch
https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
Issue Tracking
https://github.com/kjur/jsrsasign/pull/648
security.snyk.io
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812263
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:19375
More from jsrsasign
9.1
CVE-2026-4601
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation
9.1
CVE-2026-4599
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and…
9.1
CVE-2026-4600
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in…
7.5
CVE-2026-4602
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js
5.3
CVE-2026-4603
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt…