PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4603 Kjur CVE debrief

CVE-2026-4603 is a low-severity vulnerability affecting the jsrsasign package versions before 11.1.1. The issue arises from a division by zero error in the RSASetPublic/KEYUTIL parsing path and BigInteger.modPowInt reduction logic. An attacker can exploit this by providing a JWK with a modulus that decodes to zero, causing RSA public-key operations to produce deterministic zero outputs and conceal 'invalid key' errors. The CVSS score is 2, indicating a low severity. Affected products include jsrsasign package versions before 11.1.1. Defenders should assess their exposure and prioritize patching.

Vendor
Kjur
Product
jsrsasign
CVSS
LOW 2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-23
Original CVE updated
2026-06-22
Advisory published
2026-03-23
Advisory updated
2026-06-22

Who should care

Developers and administrators using the jsrsasign package in their applications, especially those relying on RSA public-key operations for verification and encryption, should be aware of this vulnerability. Given the low severity, it is still essential to address this issue to prevent potential exploitation and ensure the integrity of cryptographic operations.

Technical summary

The vulnerability is caused by a division by zero error in the jsrsasign package. Specifically, the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js are affected. An attacker can exploit this by crafting a JWK with a modulus that decodes to zero. This causes RSA public-key operations (e.g., verify and encryption) to produce deterministic zero outputs, effectively hiding 'invalid key' errors. The vulnerability has a CVSS score of 2, indicating low severity.

Defensive priority

Low priority, but recommended to prevent potential exploitation

Recommended defensive actions

  • Inventory and assess the use of jsrsasign package versions before 11.1.1
  • Review and apply the patch from version 11.1.1 or later
  • Monitor for and restrict suspicious JWK inputs
  • Verify cryptographic operations for anomalies
  • Update documentation and procedures for handling cryptographic key management

Evidence notes

The primary evidence for this vulnerability comes from the NVD and CVE records. The jsrsasign package versions before 11.1.1 are affected. The vulnerability allows attackers to cause division by zero errors through specially crafted JWK inputs. Defenders should verify the version of jsrsasign in use and review official advisories for mitigation steps.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-4603 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-4603

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-4603 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4603

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.