Skip to content
Fencer Vulns
high 8.7

CVE-2026-4601 json

jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction

published 2026-03-23 7 mo ago modified 2026-09-10 59 d ago also GHSA-w8q8-93cx-6h7r , EUVD-2026-14377

cvss
8.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

Patch / fix

  • npm jsrsasign 11.1.1
  • n/a jsrsasign 11.1.1
  • Red Hat Migration Toolkit for Virtualization 2.1 1779139872
  • Red Hat Migration Toolkit for Virtualization 2.9 1778927462
  • Red Hat Red Hat Quay 3.10 1775169155
  • Red Hat Red Hat Quay 3.12 1775253092
  • Red Hat Red Hat Quay 3.15 1775169219
  • Red Hat Red Hat Quay 3.16 1779204086
  • Red Hat Red Hat Quay 3.9 1775169218

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-4601 updated cvss 8.7

jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing

  • Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Virtualization 2.9 migration-toolkit-virtualization 1778927462
    fixed: vendor fix RHSA-2026:19410
  • Red Hat Migration Toolkit for Virtualization 2.10 migration-toolkit-virtualization 1779139872
    fixed: vendor fix RHSA-2026:19409
  • Red Hat Quay 3.9 quay 1775169218
    fixed: vendor fix RHSA-2026:6926
  • Red Hat Quay 3.10 quay 1775169155
    fixed: vendor fix RHSA-2026:6912
  • Red Hat Quay 3.12 quay 1775253092
    fixed: vendor fix RHSA-2026:6720
  • Red Hat Quay 3.15 quay 1775169219
    fixed: vendor fix RHSA-2026:6568
  • Red Hat Quay 3.16 quay 1779204086
    fixed: vendor fix RHSA-2026:19375
show 1 more
  • Red Hat Migration Toolkit for Virtualization 2.9 migration-toolkit-virtualization 1779084876, migration-toolkit-virtualization 1779085127, migration-toolkit-virtualization 1779085283, migration-toolkit-virtualization 1779085438, migration-toolkit-virtualization 1779085916, migration-toolkit-virtualization 1779085935, +5 more Red Hat Migration Toolkit for Virtualization 2.10 migration-toolkit-virtualization 1779138168, migration-toolkit-virtualization 1779138199, migration-toolkit-virtualization 1779138211, migration-toolkit-virtualization 1779138271, migration-toolkit-virtualization 1779138320, migration-toolkit-virtualization 1779138332, +7 more Red Hat Quay 3.9 quay 1774885670, quay 1774885680, quay 1774885682, quay 1774885717, quay 1774885725, quay 1774886457, +3 more Red Hat Quay 3.10 quay 1774885559, quay 1774885579, quay 1774885592, quay 1774885636, quay 1774885638, quay 1774886143, +1 more Red Hat Quay 3.12 quay 1774885546, quay 1774885564, quay 1774885572, quay 1774885604, quay 1774885641, quay 1774886107, +3 more Red Hat Quay 3.15 quay 1774979159, quay 1774979227, quay 1774980222, quay 1774980224, quay 1774984603, quay 1775183105, +3 more
    +1 more products
    Red Hat Quay 3.16 quay 1778704509, quay 1778704515, quay 1778704550, quay 1778704556, quay 1778705015, quay 1778705065, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
7 mo ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gist.github.com https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.4 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
CNA 3.1 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P
CISA ADP 3.1 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CNA 4.0 8.8 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm jsrsasign
<11.1.1
11.1.1

Affected products

  • n/a jsrsasign
  • n/a org.webjars.npm:jsrsasign
  • Red Hat Migration Toolkit for Virtualization 2.1
  • Red Hat Migration Toolkit for Virtualization 2.9
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.9

Classification

Weakness
  • CWE-325 Missing Cryptographic Step

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.