CVE-2026-4601

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-4601
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

8.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586 Exploit Mitigation Third Party Advisory
https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb Patch
https://github.com/kjur/jsrsasign/pull/645 Issue Tracking
https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:jsrsasign_project:jsrsasign:*:*:*:*:*:node.js:*:*
History

29 Apr 2026, 01:00

Type Values Removed Values Added
Summary
  • (es) Las versiones del paquete jsrsasign anteriores a la 11.1.1 son vulnerables a Paso Criptográfico Faltante a través del proceso KJUR.crypto.DSA.signWithMessageHash en la implementación de firma DSA. Un atacante puede recuperar la clave privada forzando a r o s a ser cero, de modo que la biblioteca emite una firma inválida sin reintentar, y luego resuelve para x a partir de la firma resultante.

23 Mar 2026, 16:10

Type Values Removed Values Added
First Time Jsrsasign Project
Jsrsasign Project jsrsasign
CPE cpe:2.3:a:jsrsasign_project:jsrsasign:*:*:*:*:*:node.js:*:*
References () https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586 - () https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586 - Exploit, Mitigation, Third Party Advisory
References () https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb - () https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb - Patch
References () https://github.com/kjur/jsrsasign/pull/645 - () https://github.com/kjur/jsrsasign/pull/645 - Issue Tracking
References () https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941 - () https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941 - Third Party Advisory

23 Mar 2026, 06:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-23 06:16

Updated : 2026-04-29 01:00

NVD link : CVE-2026-4601

Mitre link : CVE-2026-4601

CVE.ORG link : CVE-2026-4601

JSON object : View

Products Affected

jsrsasign_project

  • jsrsasign
CWE
CWE-325

Missing Cryptographic Step