Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-8jb1-w888-fkh1
Vulnerability ID VCID-8jb1-w888-fkh1
Aliases CVE-2026-4598
GHSA-8g7p-jf3g-gxcp
Summary Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-1287 Improper Validation of Specified Type of Input
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-4598.json
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2026-4598
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2026-4598
cvssv3.1 7.5 https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
cvssv3.1 7.5 https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
cvssv4 7.7 https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
cvssv4 8.7 https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
generic_textual HIGH https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
ssvc Track https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-8g7p-jf3g-gxcp
cvssv3.1 7.5 https://github.com/kjur/jsrsasign
cvssv4 7.7 https://github.com/kjur/jsrsasign
generic_textual HIGH https://github.com/kjur/jsrsasign
cvssv3.1 7.5 https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
cvssv3.1 7.5 https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
cvssv4 7.7 https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
cvssv4 8.7 https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
generic_textual HIGH https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
ssvc Track https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
cvssv3.1 7.5 https://github.com/kjur/jsrsasign/pull/648
cvssv3.1 7.5 https://github.com/kjur/jsrsasign/pull/648
cvssv4 7.7 https://github.com/kjur/jsrsasign/pull/648
cvssv4 8.7 https://github.com/kjur/jsrsasign/pull/648
generic_textual HIGH https://github.com/kjur/jsrsasign/pull/648
ssvc Track https://github.com/kjur/jsrsasign/pull/648
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-4598
cvssv4 7.7 https://nvd.nist.gov/vuln/detail/CVE-2026-4598
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-4598
cvssv3.1 7.5 https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
cvssv3.1 7.5 https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
cvssv4 7.7 https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
cvssv4 8.7 https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
generic_textual HIGH https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
ssvc Track https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-4598.json
https://api.first.org/data/v1/epss?cve=CVE-2026-4598
https://github.com/kjur/jsrsasign
https://nvd.nist.gov/vuln/detail/CVE-2026-4598
2450210 https://bugzilla.redhat.com/show_bug.cgi?id=2450210
648 https://github.com/kjur/jsrsasign/pull/648
a1bf5cd4547cc630d2dcc5e761de8264 https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
ca5b027240287a1e71fe63019fc4400332594323 https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
GHSA-8g7p-jf3g-gxcp https://github.com/advisories/GHSA-8g7p-jf3g-gxcp
RHSA-2026:19375 https://access.redhat.com/errata/RHSA-2026:19375
RHSA-2026:19409 https://access.redhat.com/errata/RHSA-2026:19409
RHSA-2026:19410 https://access.redhat.com/errata/RHSA-2026:19410
RHSA-2026:22840 https://access.redhat.com/errata/RHSA-2026:22840
RHSA-2026:23361 https://access.redhat.com/errata/RHSA-2026:23361
RHSA-2026:6568 https://access.redhat.com/errata/RHSA-2026:6568
RHSA-2026:6720 https://access.redhat.com/errata/RHSA-2026:6720
SNYK-JS-JSRSASIGN-15370938 https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-4598.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P Found at https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-23T14:37:02Z/ Found at https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/kjur/jsrsasign
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/kjur/jsrsasign
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P Found at https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-23T14:37:02Z/ Found at https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P Found at https://github.com/kjur/jsrsasign/pull/648
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/kjur/jsrsasign/pull/648
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/kjur/jsrsasign/pull/648
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/kjur/jsrsasign/pull/648
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-23T14:37:02Z/ Found at https://github.com/kjur/jsrsasign/pull/648
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-4598
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2026-4598
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P Found at https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-23T14:37:02Z/ Found at https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938
Exploit Prediction Scoring System (EPSS)
Percentile 0.23349
EPSS Score 0.00078
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:46:36.747090+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/4xxx/CVE-2026-4598.json 38.6.0