CVE-2026-4603 Details
Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.
A division by zero vulnerability has been identified in the jsrsasign cryptographic library, affecting versions prior to 11.1.1. The issue arises in the RSA public key parsing process, where a JSON Web Key (JWK) with a modulus that decodes to zero can be accepted. This malformed key leads to RSA operations, such as verification and encryption, producing deterministic zero outputs. The vulnerability is compounded by the library's BigInteger division logic, which silently returns zero instead of throwing an error. As a result, applications that import RSA keys from untrusted sources and rely on the library's validation may unknowingly accept invalid keys, potentially undermining the confidentiality of encrypted data.
Users can upgrade to jsrsasign version 11.1.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Kr0emer/5366b7364c4fbf7e754bc377f321e9f3 | [email protected] | ExploitMitigationThird Party Advisory |
| https://github.com/kjur/jsrsasign/commit/dc41d49fac4297e7a737a3ef8ebd0aa9c49ef93f | [email protected] | Patch |
| https://github.com/kjur/jsrsasign/pull/649 | [email protected] | Issue Tracking |
| https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371176 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-369 | Divide By Zero | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kjur jsrsasign | < 11.1.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CPE Deprecation Remap | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |