CVE-2026-4601 describes a cryptographic vulnerability in jsrsasign prior to version 11.1.1, specifically in the KJUR.crypto.DSA.signWithMessageHash function. The vulnerability arises because the library does not retry signature generation when the DSA signature components r or s are zero, resulting in an invalid signature. An attacker can exploit this behavior to recover the private key by forcing these values and solving for the key from the invalid signature. Red Hat products that incorporate jsrsasign, such as Migration Toolkit for Virtualization and Red Hat Quay, are impacted. Red Hat has acknowledged the issue but currently does not have a mitigation or fix that meets their product security standards for ease of use, applicability, and stability.

The vulnerability allows an unauthenticated attacker to recover the private key used in the DSA signing process by exploiting the missing cryptographic step. This compromises the confidentiality and integrity of cryptographic operations relying on the affected jsrsasign versions. The impact is critical as private key recovery can lead to signature forgery and impersonation. Red Hat products using the vulnerable library are affected, potentially exposing them to cryptographic key compromise.

Currently, Red Hat states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates or fixes. Until a fix is released, consider avoiding use of the vulnerable jsrsasign versions in security-sensitive contexts or replacing the library with a secure alternative if feasible.