PT-2026-27059 · Jsrsasign · Jsrsasign

Kr0Emer · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2026-4603

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 11.1.1

Description The jsrsasign package contains a flaw related to division by zero. This issue stems from the RSASetPublic/KEYUTIL parsing path within the 'ext/rsa.js' file and the BigInteger.modPowInt reduction logic in 'ext/jsbn.js'. An attacker can exploit this by providing a JSON Web Key (JWK) with a modulus that decodes to zero, causing RSA public-key operations, such as verification and encryption, to produce deterministic zero outputs and conceal “invalid key” errors.

Recommendations Update jsrsasign to version 11.1.1 or later.

Exploit

Correção

Divide By Zero

Enumeração de Fraquezas

CWE-369

Identificadores relacionados

CVE-2026-4603

GHSA-464Q-CQXQ-XHGR

Produtos afetados

Jsrsasign

Referências · 10

• 🔥 https://gist.github.com/Kr0emer/5366b7364c4fbf7e754bc377f321e9f3 · Exploit
• https://github.com/kjur/jsrsasign · Nota
• https://github.com/kjur/jsrsasign/commit/dc41d49fac4297e7a737a3ef8ebd0aa9c49ef93f · Correção
• https://github.com/kjur/jsrsasign/pull/649 · Nota
• https://twitter.com/CVEarity/status/2036123646469743054 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-464q-cqxq-xhgr · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-4603 · Aviso do Fabricante
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371176 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4603 · Nota de Segurança
• https://twitter.com/CVEnew/status/2035992475618181519 · Publicação no Twitter