Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-t65e-dnqv-r3h2
Vulnerability ID VCID-t65e-dnqv-r3h2
Aliases CVE-2026-4599
GHSA-5jx8-q4cp-rhh6
Summary Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1023 Incomplete Comparison with Missing Factors
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 9.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-4599.json
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2026-4599
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2026-4599
cvssv3.1 9.1 https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
cvssv4 9.3 https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
generic_textual CRITICAL https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
ssvc Track https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-5jx8-q4cp-rhh6
cvssv3.1 9.1 https://github.com/kjur/jsrsasign
cvssv4 9.3 https://github.com/kjur/jsrsasign
generic_textual CRITICAL https://github.com/kjur/jsrsasign
cvssv3.1 9.1 https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
cvssv4 9.3 https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
generic_textual CRITICAL https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
ssvc Track https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
cvssv3.1 9.1 https://github.com/kjur/jsrsasign/pull/647
cvssv4 9.3 https://github.com/kjur/jsrsasign/pull/647
generic_textual CRITICAL https://github.com/kjur/jsrsasign/pull/647
ssvc Track https://github.com/kjur/jsrsasign/pull/647
cvssv3.1 9.1 https://nvd.nist.gov/vuln/detail/CVE-2026-4599
cvssv4 9.3 https://nvd.nist.gov/vuln/detail/CVE-2026-4599
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2026-4599
cvssv3.1 9.1 https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939
cvssv4 9.3 https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939
generic_textual CRITICAL https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939
ssvc Track https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-4599.json
https://api.first.org/data/v1/epss?cve=CVE-2026-4599
https://github.com/kjur/jsrsasign
https://nvd.nist.gov/vuln/detail/CVE-2026-4599
081681818b51605c91945126d74b4f20 https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
2450207 https://bugzilla.redhat.com/show_bug.cgi?id=2450207
647 https://github.com/kjur/jsrsasign/pull/647
ee4b013478366cb16cea9a4bdfb218b6077f83b1 https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
GHSA-5jx8-q4cp-rhh6 https://github.com/advisories/GHSA-5jx8-q4cp-rhh6
RHSA-2026:19375 https://access.redhat.com/errata/RHSA-2026:19375
RHSA-2026:19409 https://access.redhat.com/errata/RHSA-2026:19409
RHSA-2026:19410 https://access.redhat.com/errata/RHSA-2026:19410
RHSA-2026:6568 https://access.redhat.com/errata/RHSA-2026:6568
RHSA-2026:6720 https://access.redhat.com/errata/RHSA-2026:6720
RHSA-2026:6912 https://access.redhat.com/errata/RHSA-2026:6912
RHSA-2026:6926 https://access.redhat.com/errata/RHSA-2026:6926
SNYK-JS-JSRSASIGN-15370939 https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-4599.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-03-23T14:39:36Z/ Found at https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/kjur/jsrsasign
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/kjur/jsrsasign
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-03-23T14:39:36Z/ Found at https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/kjur/jsrsasign/pull/647
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/kjur/jsrsasign/pull/647
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-03-23T14:39:36Z/ Found at https://github.com/kjur/jsrsasign/pull/647
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-4599
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-4599
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-03-23T14:39:36Z/ Found at https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939
Exploit Prediction Scoring System (EPSS)
Percentile 0.18253
EPSS Score 0.00057
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:46:09.646870+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/4xxx/CVE-2026-4599.json 38.6.0