CVE-2026-4601CWE-325

CVE-2026-4601

High · published March 23, 2026

CVSS v3.1
8.7
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00484 · 40.8th percentile
Weakness
CWE-325 · Missing Cryptographic Step
Published
2026-03-23T10:16Z
Affected products (1)
ProductVersionsFixed in
kjur/jsrsasign< 11.1.111.1.1
References (15)
https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586 · [email protected]https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb · [email protected]https://github.com/kjur/jsrsasign/pull/645 · [email protected]https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812269 · [email protected]https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941 · [email protected]https://access.redhat.com/errata/RHSA-2026:19375 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:19409 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:19410 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:6568 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:6720 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:6912 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:6926 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-4601 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2450209 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4601.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 23 MAR 05:00Z
    Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA…
    cvelistv5