CVE-2026-4599
CRITICAL
9,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
CRITICAL
9,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: none
Description
AI Translation Available
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.
1023
Incomplete Comparison with Missing Factors
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Access Control
Potential Impacts:
Alter Execution Logic
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83…
https://github.com/kjur/jsrsasign/pull/647
https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939