CVE-2026-4599 is a vulnerability in the jsrsasign package affecting versions from 7.0.0 up to and including 11.1.1. The issue arises from incomplete comparison logic in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions within src/crypto-1.1.js. This flaw causes acceptance of out-of-range candidates due to incorrect compareTo checks, which biases DSA nonces used during signature generation. Exploiting this bias enables an attacker to recover the private key. The vulnerability is tracked under CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). Red Hat has published multiple advisories addressing this vulnerability, indicating that patches or updates are available for affected products.

An attacker exploiting this vulnerability can recover private keys by leveraging biased DSA nonces caused by incomplete comparison checks. This compromises the cryptographic integrity of signatures generated using the affected jsrsasign versions, potentially leading to unauthorized actions or data breaches where these keys are used. The CVSS 4.0 score of 9.3 reflects critical impact with network attack vector, low attack complexity, and no privileges or user interaction required.

Red Hat has issued multiple advisories referencing CVE-2026-4599, indicating that fixes are available. Users of affected jsrsasign versions (7.0.0 through 11.1.1) should apply the vendor-provided patches or update to fixed versions as per Red Hat's guidance. Patch status is confirmed by vendor advisories linked in the input data. No additional mitigation steps are specified beyond applying these official fixes.