CVE-2026-4598
CVE-2026-4598
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
CVSS 8.7 · Alta · EPSS 0,6% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
jsrsasign
- Versiones
- ≥ 0, < 11.1.1: Afectada (semver)
Actualiza a 11.1.1
org.webjars.npm:jsrsasign
- Versiones
- ≥ 0: Afectada (semver)
Sin corrección publicada
jsrsasign npm
- Intervalos de versiones afectados
- SEMVER: < 11.1.1
Actualiza a 11.1.1
Fuentes originales
- https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812263
- https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
- https://github.com/kjur/jsrsasign/pull/648
- https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
- https://access.redhat.com/security/cve/CVE-2026-4598
- https://bugzilla.redhat.com/show_bug.cgi?id=2450210
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4598.json
- https://access.redhat.com/errata/RHSA-2026:19409
- https://access.redhat.com/errata/RHSA-2026:19410
- https://access.redhat.com/errata/RHSA-2026:22840
- https://access.redhat.com/errata/RHSA-2026:6720
- https://access.redhat.com/errata/RHSA-2026:6568
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:23361
- https://nvd.nist.gov/vuln/detail/CVE-2026-4598