7.5
High
CVE-2026-4602 Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to…
Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| jsrsasign 11.1 | earliest → < 11.1.1 | 11.1.1 |
| org.webjars.npm:jsrsasign | Versions not published | |
| Migration Toolkit for Virtualization 2.1 1779139872 | earliest → < 1779139872 | 1779139872 |
| Migration Toolkit for Virtualization 2.9 1778927462 | earliest → < 1778927462 | 1778927462 |
| Red Hat Quay 3.12 1775253092 | earliest → < 1775253092 | 1775253092 |
| Red Hat Quay 3.15 1775169219 | earliest → < 1775169219 | 1775169219 |
| Red Hat Quay 3.16 1779204086 | earliest → < 1779204086 | 1779204086 |
| Red Hat Quay 3.1 1775169155 | earliest → < 1775169155 | 1775169155 |
| Red Hat Quay 3.9 1775169218 | earliest → < 1775169218 | 1775169218 |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Quay 3.10 1775169155 | earliest → < 1775169155 | 1775169155 |
Other CVEs of jsrsasign
The 8 CVEs of jsrsasign →
CVE-2026-4603
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL…
5.9
Medium
CVE-2026-4601
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
8.7
High
CVE-2026-4599
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing…
9.1
Critical
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in…
7.5
High