VULNERABILITY INTELLIGENCE

CVE-2026-4598

CVSS score7.5 HIGH
EPSS probability0.56%
CISA KEVNot currently listed
Published2026-03-23
Last modified2026-09-10
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Weakness classification

  • report@snyk.io: CWE-835
  • 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-1287

Primary references