CVE-2026-4603

Katalog CVE

CVSS 5.3 · Medium EPSS 0,11%

Kerentanan Divide By Zero pada kjur jsrsasign. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.

Rincian

Terbit di NVD

23 Maret 2026

Terakhir diubah

22 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-369: Divide By Zero

EPSS (30 hari)

0,11% peluang dieksploitasi; lebih tinggi dari 1,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kjur/jsrsasign/commit/dc41d49fac4297e7a737a3ef8ebd0aa9c49ef93f patch
• https://gist.github.com/Kr0emer/5366b7364c4fbf7e754bc377f321e9f3 exploit · mitigasi · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371176 advisory pihak ketiga
• https://github.com/kjur/jsrsasign/pull/649 issue tracking