CVE-2026-4598: kjur jsrsasign Infinite Loop

Vulnerability summary

CVE-2026-4598 is a high (CVSS 8.7) Infinite Loop vulnerability in kjur jsrsasign. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 62.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-03-2026
   PublishedVulnerability first disclosed.
2. 10-09-2026
   Last modifiedVulnerability information updated.

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
• CWE-1287Improper Validation of Specified Type of InputThe product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.