High severity · published Mar 23, 2026
CVE-2026-4602
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
jsrsasign ·
before 11.1.1 · source: vendor, NVD
OR
org.webjars.npm:jsrsasign ·
0 · source: vendor
MT
Migration Toolkit for Virtualization 2.1 · Red Hat
All versions, or not specified · source: CISA
MT
Migration Toolkit for Virtualization 2.9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.12 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.15 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.16 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.9 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4602
Exploit
https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5
Patch
https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195
Issue Tracking
https://github.com/kjur/jsrsasign/pull/650
security.snyk.io
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812274
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:19375
More from jsrsasign
9.1
CVE-2026-4601
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation
9.1
CVE-2026-4599
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and…
9.1
CVE-2026-4600
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in…
7.5
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation…
5.3
CVE-2026-4603
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt…