CVE-2026-4601 HIGH

CVE-2026-4601

Vendor N/A
Product jsrsasign
Weakness CWE-325
Published March 23, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P

What the vulnerability does

01Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

Key dates

02Disclosure timeline

March 23, 2026 CVE published
June 30, 2026 Record updated