jsrsasign: jsrsasign: Cryptographic operations impacted by division by zero via malicious JSON Web Key
Published Mar 23, 2026
5.1
MEDIUMCVSS 4.0
EPSS 0.11%
Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.
Affected products
- Vendor n/a Product Jsrsasign Defaultn/a
- Version 0StatusaffectedConstraints<11.1.1
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Jsrsasign | n/a |
|
No data.
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-console-plugin-rhel9
Fix deferred
Migration Toolkit for Virtualization
mtv-candidate/mtv-console-plugin-rhel9
Fix deferred
Red Hat Quay 3
quay/quay-rhel8
Fix deferred
Red Hat Quay 3
quay/quay-rhel9
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-console-plugin-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Virtualization | mtv-candidate/mtv-console-plugin-rhel9 | Fix deferred | n/a |
| Red Hat Quay 3 | quay/quay-rhel8 | Fix deferred | n/a |
| Red Hat Quay 3 | quay/quay-rhel9 | Fix deferred | n/a |
jsrsasign
npm
Introduced 0 Fixed 11.1.1
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | jsrsasign | 0 | 11.1.1 |
Remediation
Red Hat statement
This flaw has a MODERATE impact. A division by zero vulnerability in jsrsasign, as used in Red Hat Migration Toolkit for Virtualization and Red Hat Quay, allows an attacker to provide a malicious JSON Web Key (JWK) that can lead to incorrect RSA public-key operation outputs and mask key validation errors. This compromises the reliability and integrity of cryptographic processes within affected Red Hat products.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References (10)
- https://access.redhat.com/security/cve/CVE-2026-4603 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2450205 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14380 Advisory
- https://gist.github.com/Kr0emer/5366b7364c4fbf7e754bc377f321e9f3 ExploitMitigationThird Party Advisory
- https://github.com/advisories/GHSA-464q-cqxq-xhgr Advisory
- https://github.com/kjur/jsrsasign/commit/dc41d49fac4297e7a737a3ef8ebd0aa9c49ef93f Patch
- https://github.com/kjur/jsrsasign/pull/649 Issue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2026-4603
- https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371176 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-4603
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-4603 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2450205 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14380 | Advisory | |
| https://gist.github.com/Kr0emer/5366b7364c4fbf7e754bc377f321e9f3 | ExploitMitigationThird Party Advisory | |
| https://github.com/advisories/GHSA-464q-cqxq-xhgr | Advisory | |
| https://github.com/kjur/jsrsasign/commit/dc41d49fac4297e7a737a3ef8ebd0aa9c49ef93f | Patch | |
| https://github.com/kjur/jsrsasign/pull/649 | Issue Tracking | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-4603 | ||
| https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371176 | Third Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2026-4603 |
Change history (0)
No recorded changes yet.