PT-2026-27059 · Jsrsasign · Jsrsasign

Kr0Emer · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-4603

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 11.1.1

Description The jsrsasign package contains a flaw related to division by zero. This issue stems from the RSASetPublic/KEYUTIL parsing path within the 'ext/rsa.js' file and the BigInteger.modPowInt reduction logic in 'ext/jsbn.js'. An attacker can exploit this by providing a JSON Web Key (JWK) with a modulus that decodes to zero, causing RSA public-key operations, such as verification and encryption, to produce deterministic zero outputs and conceal “invalid key” errors.

Recommendations Update jsrsasign to version 11.1.1 or later.

Exploit

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

CVE-2026-4603

GHSA-464Q-CQXQ-XHGR

Affected Products

Jsrsasign

References · 10

• 🔥 https://gist.github.com/Kr0emer/5366b7364c4fbf7e754bc377f321e9f3 · Exploit
• https://github.com/kjur/jsrsasign/commit/dc41d49fac4297e7a737a3ef8ebd0aa9c49ef93f · Patch
• https://osv.dev/vulnerability/GHSA-464q-cqxq-xhgr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-4603 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4603 · Security Note
• https://github.com/kjur/jsrsasign · Note
• https://github.com/kjur/jsrsasign/pull/649 · Note
• https://twitter.com/CVEarity/status/2036123646469743054 · Twitter Post
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371176 · Note
• https://twitter.com/CVEnew/status/2035992475618181519 · Twitter Post