CVE-2026-4602

Katalog CVE

CVSS 7.5 · High EPSS 0,88%

Kerentanan Incorrect Conversion between Numeric Types pada kjur jsrsasign. Skor CVSS 3.1 7.5 (High) menurut snyk.io.

Deskripsi (NVD)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.

Rincian

Terbit di NVD

23 Maret 2026

Terakhir diubah

10 September 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber snyk.io
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-681: Incorrect Conversion between Numeric Types

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 57,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195 patch
• https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5 exploit · mitigasi · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175 advisory pihak ketiga
• https://github.com/kjur/jsrsasign/pull/650 issue tracking
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812274
• https://access.redhat.com/errata/RHSA-2026:19375
• https://access.redhat.com/errata/RHSA-2026:19409
• https://access.redhat.com/errata/RHSA-2026:19410
• https://access.redhat.com/errata/RHSA-2026:6568
• https://access.redhat.com/errata/RHSA-2026:6720
• https://access.redhat.com/errata/RHSA-2026:6912
• https://access.redhat.com/errata/RHSA-2026:6926
• https://access.redhat.com/security/cve/CVE-2026-4602
• https://bugzilla.redhat.com/show_bug.cgi?id=2450206
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4602.json