Vulnerability in Jsrsasign Project
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.010 (62.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 62.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.010 · change: +0.005
Affected products
- Jsrsasign Project
- Kjur Jsrsasign
- Jsrsasign — versions 0
- Org.webjars.npm:jsrsasign — versions 0
Weakness classification (CWE)
References
- security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938 (Third Party Advisory)
- gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264 (Exploit, Third Party Advisory, Mitigation)
- github.com/kjur/jsrsasign/pull/648 (Issue Tracking)
- github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323 (Patch)
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812263
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-4598?
- CVE-2026-4598 is a high-severity vulnerability in Jsrsasign Project, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 7.5/10. Published 2026-03-23.
- How severe is CVE-2026-4598?
- High severity. CVSS v3 base score is 7.5 out of 10.