The vulnerability CVE-2026-4598 affects jsrsasign versions prior to 11.1.1. The bnModInverse function in ext/jsbn2.js, part of the BigInteger.modInverse implementation, does not properly handle zero or negative inputs. When such crafted inputs (e.g., modInverse(0, m) or modInverse(-1, m)) are supplied, the function enters an infinite loop, causing the process to hang indefinitely. This flaw can be exploited remotely to cause a permanent denial of service. Red Hat products that incorporate jsrsasign, such as the Migration Toolkit for Virtualization and Red Hat Quay, are impacted. Red Hat has analyzed the issue but currently does not offer a fix or effective mitigation that meets their standards for ease of use, applicability, and stability.

An attacker can remotely cause a permanent denial of service by supplying crafted zero or negative inputs to the vulnerable bnModInverse function, resulting in an infinite loop that hangs the affected process. This impacts availability but does not affect confidentiality or integrity. The vulnerability affects software components used in Red Hat products, potentially disrupting services relying on jsrsasign.

Currently, no official fix or patch is available for this vulnerability. Red Hat states that available mitigation options either do not exist or do not meet their criteria for ease of use, applicability, or stability. Users should monitor vendor advisories for updates and consider upgrading to versions of jsrsasign 11.1.1 or later when available. For affected Red Hat products, consult Red Hat support or Technical Account Managers for guidance.