Skip to content
fr Sign in
7.5 High

CVE-2026-4598 Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in…

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Affected products and versions

Product Affected versions Fixed in
jsrsasign 11.1 earliest → < 11.1.1 11.1.1
org.webjars.npm:jsrsasign Versions not published
Migration Toolkit for Virtualization 2.1 1779139872 earliest → < 1779139872 1779139872
Migration Toolkit for Virtualization 2.9 1778927462 earliest → < 1778927462 1778927462
Red Hat Quay 3.12 1775253092 earliest → < 1775253092 1775253092
Red Hat Quay 3.15 1775169219 earliest → < 1775169219 1775169219
Red Hat Quay 3.16 1779204086 earliest → < 1779204086 1779204086
Red Hat Quay 3.1 1779822261 earliest → < 1779822261 1779822261
Red Hat Quay 3.9 1779811473 earliest → < 1779811473 1779811473
Show the other branch
Product Affected versions Fixed in
Red Hat Quay 3.10 1779822261 earliest → < 1779822261 1779822261

References

Timeline

  1. Published
  2. Last modified

Other CVEs of jsrsasign

The 8 CVEs of jsrsasign →
CVE-2026-4603 Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL… 5.9 Medium CVE-2026-4601 Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the… 8.7 High CVE-2026-4599 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing… 9.1 Critical CVE-2026-4602 Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to… 7.5 High
Track this CVE