Vulnerabilities CVE-2026-4601

CVE-2026-4601

Critical

Open

TLP:CLEAR

AI Analysis

No AI analysis yet.

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

Details

CVSS Score: 9.4
EPSS Score ⓘ: 0.30%

22.4th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
Confidence: 90%
Published: Mar 23, 2026
Last Modified: Aug 5, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.