PT-2026-27057 · Jsrsasign · Jsrsasign

Kr0Emer · Published 2026-03-23 · Updated 2026-03-28 · CVE-2026-4601

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 11.1.1

Description The jsrsasign package, versions prior to 11.1.1, contains a flaw in the DSA signing implementation, specifically within the KJUR.crypto.DSA.signWithMessageHash process. This issue allows an attacker to potentially recover the private key by manipulating the signing process to force r or s to be zero. The library then emits an invalid signature without retrying, enabling the attacker to solve for x and thus recover the private key.

Recommendations Update jsrsasign to version 11.1.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-325

Related Identifiers

CVE-2026-4601

GHSA-W8Q8-93CX-6H7R

Affected Products

Jsrsasign

References · 14

• 🔥 https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586 · Exploit
• https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-4601 · Security Note
• https://osv.dev/vulnerability/GHSA-w8q8-93cx-6h7r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-4601 · Vendor Advisory
• https://github.com/kjur/jsrsasign/pull/645 · Note
• https://github.com/kjur/jsrsasign · Note
• https://twitter.com/CVEarity/status/2036121117212225990 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2035976027483124216 · Twitter Post
• https://twitter.com/TheHackerWire/status/2035964192352837758 · Twitter Post
• https://twitter.com/CveFindCom/status/2035970506520674379 · Twitter Post
• https://twitter.com/zench4n/status/2037912349974339677 · Twitter Post
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941 · Note
• https://twitter.com/CVEnew/status/2035992476595408938 · Twitter Post