CVE-2026-4598: jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
(updated )
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
References
- access.redhat.com/errata/RHSA-2026:19375
- access.redhat.com/errata/RHSA-2026:19409
- access.redhat.com/errata/RHSA-2026:19410
- access.redhat.com/errata/RHSA-2026:22840
- access.redhat.com/errata/RHSA-2026:23361
- access.redhat.com/errata/RHSA-2026:6568
- access.redhat.com/errata/RHSA-2026:6720
- access.redhat.com/security/cve/CVE-2026-4598
- bugzilla.redhat.com/show_bug.cgi?id=2450210
- gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
- github.com/advisories/GHSA-8g7p-jf3g-gxcp
- github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
- github.com/kjur/jsrsasign/pull/648
- nvd.nist.gov/vuln/detail/CVE-2026-4598
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4598.json
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812263
- security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
Code Behaviors & Features
Detect and mitigate CVE-2026-4598 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →