CVE-2026-4601: Missing Cryptographic Step in jsrsasign
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.
AI Analysis
Technical Summary
CVE-2026-4601 affects jsrsasign versions prior to 11.1.1. The vulnerability arises from a missing cryptographic step in the KJUR.crypto.DSA.signWithMessageHash function. Specifically, when the signature components r or s are zero, the library emits an invalid signature without retrying the signing process. This flaw enables an attacker to recover the private key by solving for x from the invalid signature. The CVSS 4.0 score is 9.4, indicating critical severity. Multiple Red Hat advisories reference this CVE, indicating vendor recognition and remediation efforts.
Potential Impact
An attacker can recover the private key used in DSA signing by exploiting the failure to retry when r or s equals zero, leading to invalid signatures. This compromises the cryptographic integrity and confidentiality of the private key, potentially allowing signature forgery or impersonation.
Mitigation Recommendations
A fix is available in jsrsasign version 11.1.1 and later. Users should upgrade to version 11.1.1 or newer to remediate this vulnerability. Refer to the Red Hat advisories for detailed patch information and apply all relevant updates. No additional mitigations are indicated by the vendor advisory.
CVE-2026-4601: Missing Cryptographic Step in jsrsasign
Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.
CVSS v4.0
Score 9.4critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-4601 affects jsrsasign versions prior to 11.1.1. The vulnerability arises from a missing cryptographic step in the KJUR.crypto.DSA.signWithMessageHash function. Specifically, when the signature components r or s are zero, the library emits an invalid signature without retrying the signing process. This flaw enables an attacker to recover the private key by solving for x from the invalid signature. The CVSS 4.0 score is 9.4, indicating critical severity. Multiple Red Hat advisories reference this CVE, indicating vendor recognition and remediation efforts.
Potential Impact
An attacker can recover the private key used in DSA signing by exploiting the failure to retry when r or s equals zero, leading to invalid signatures. This compromises the cryptographic integrity and confidentiality of the private key, potentially allowing signature forgery or impersonation.
Mitigation Recommendations
A fix is available in jsrsasign version 11.1.1 and later. Users should upgrade to version 11.1.1 or newer to remediate this vulnerability. Refer to the Red Hat advisories for detailed patch information and apply all relevant updates. No additional mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- snyk
- Date Reserved
- 2026-03-22T16:26:10.973Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-4601","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:19409","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:19410","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:6720","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:6568","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:6912","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:6926","vendor":"Red Hat"}]
Threat ID: 69c0d39ff4197a8e3b12db0c
Added to database: 03/23/2026, 05:46:07 UTC
Last enriched: 07/30/2026, 01:55:21 UTC
Last updated: 07/31/2026, 21:26:43 UTC
Views: 269
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.