PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4599 Kjur CVE debrief

CVE-2026-4599 is a critical vulnerability in the jsrsasign package, affecting versions from 7.0.0 to before 11.1.1. The issue stems from an incomplete comparison with missing factors in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. This flaw allows an attacker to recover the private key by exploiting incorrect compareTo checks, which accept out-of-range candidates and bias DSA nonces during signature generation. The vulnerability has a CVSS score of 9.3, indicating a high severity. Affected users should prioritize updating to a secure version to mitigate the risk of private key exposure.

Vendor
Kjur
Product
jsrsasign
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-23
Original CVE updated
2026-09-10
Advisory published
2026-03-23
Advisory updated
2026-09-10

Who should care

Developers and security teams using the jsrsasign package in their applications, especially those relying on DSA signatures for cryptographic operations, should be aware of this vulnerability. The exposure of private keys can lead to severe security breaches, including unauthorized access and data tampering. Immediate action is required to update vulnerable versions and limit potential exposure.

Technical summary

The vulnerability in jsrsasign arises from flawed compareTo checks in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. These functions are used in DSA signature generation, and the bias introduced by the incorrect comparisons can be exploited to recover the private key. The issue is particularly severe as it directly impacts the cryptographic integrity of the package, allowing for potential private key recovery and subsequent impersonation or decryption of sensitive data.

Defensive priority

High priority due to potential for private key recovery and severe security breaches

Recommended defensive actions

  • Update jsrsasign to version 11.1.1 or later
  • Review and replace any instances of vulnerable jsrsasign versions in applications
  • Monitor for any suspicious DSA signature generation activities
  • Implement compensating controls to limit exposure until patching can be completed
  • Inventory applications and services using jsrsasign for immediate remediation

Evidence notes

The CVE-2026-4599 vulnerability is confirmed in jsrsasign versions from 7.0.0 to before 11.1.1. Evidence from the NVD and Snyk indicates that the flaw is due to incorrect compareTo checks in specific functions, leading to biased DSA nonces. Users should verify their package versions and update to a secure version to prevent potential private key recovery attacks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-4599 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-4599

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-4599 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4599

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.