jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-4598US | — | — | ||
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2026:19375WEB
- https://access.redhat.com/errata/RHSA-2026:19409WEB
- https://access.redhat.com/errata/RHSA-2026:19410WEB
- https://access.redhat.com/errata/RHSA-2026:22840WEB
- https://access.redhat.com/errata/RHSA-2026:23361WEB
- https://access.redhat.com/errata/RHSA-2026:6568WEB
- https://access.redhat.com/errata/RHSA-2026:6720WEB
- https://access.redhat.com/security/cve/CVE-2026-4598WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan