CVE-2026-4598: Infinite loop in jsrsasign
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
AI Analysis
Technical Summary
CVE-2026-4598 affects jsrsasign versions prior to 11.1.1. The vulnerability arises from the bnModInverse function in ext/jsbn2.js, where the BigInteger.modInverse method does not properly handle zero or negative inputs. This flaw can cause the function to enter an infinite loop, resulting in a permanent hang of the affected process. The issue is classified under CWE-1287. Red Hat has published multiple advisories and errata referencing this CVE, indicating that fixes are available in updated packages.
Potential Impact
An attacker can supply crafted inputs (such as zero or negative values) to the modInverse function, causing the application to enter an infinite loop and hang indefinitely. This results in a denial of service condition, potentially impacting availability of systems using vulnerable versions of jsrsasign. There are no reports of exploitation in the wild at this time.
Mitigation Recommendations
Red Hat has released updated packages that address this vulnerability. Users should apply the official patches provided by Red Hat as referenced in their advisories (e.g., RHSA-2026:19409 and others). Since this is not a cloud service, remediation requires updating the vulnerable jsrsasign package to version 11.1.1 or later. Patch status is confirmed by Red Hat advisories. No additional mitigations are specified beyond applying these updates.
CVE-2026-4598: Infinite loop in jsrsasign
Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-4598 affects jsrsasign versions prior to 11.1.1. The vulnerability arises from the bnModInverse function in ext/jsbn2.js, where the BigInteger.modInverse method does not properly handle zero or negative inputs. This flaw can cause the function to enter an infinite loop, resulting in a permanent hang of the affected process. The issue is classified under CWE-1287. Red Hat has published multiple advisories and errata referencing this CVE, indicating that fixes are available in updated packages.
Potential Impact
An attacker can supply crafted inputs (such as zero or negative values) to the modInverse function, causing the application to enter an infinite loop and hang indefinitely. This results in a denial of service condition, potentially impacting availability of systems using vulnerable versions of jsrsasign. There are no reports of exploitation in the wild at this time.
Mitigation Recommendations
Red Hat has released updated packages that address this vulnerability. Users should apply the official patches provided by Red Hat as referenced in their advisories (e.g., RHSA-2026:19409 and others). Since this is not a cloud service, remediation requires updating the vulnerable jsrsasign package to version 11.1.1 or later. Patch status is confirmed by Red Hat advisories. No additional mitigations are specified beyond applying these updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- snyk
- Date Reserved
- 2026-03-22T16:25:51.590Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-4598","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:19409","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:19410","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:6720","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:6568","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:22840","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:23361","vendor":"Red Hat"}]
Threat ID: 69c0d39df4197a8e3b12da3d
Added to database: 03/23/2026, 05:46:05 UTC
Last enriched: 07/24/2026, 22:45:03 UTC
Last updated: 07/31/2026, 21:26:48 UTC
Views: 150
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.