Security readout for executives and security teams
Plain-English summary
CVE-2026-4598 is a denial-of-service flaw in jsrsasign. If an application lets an attacker influence values passed into a BigInteger modular inverse operation, the process can hang indefinitely. The main business risk is service unavailability, not data theft or code execution.
Executive priority
Treat as a high-priority availability issue for internet-facing or authentication-related services using jsrsasign. Prioritize patching where the library processes user-supplied cryptographic or numeric inputs. This is less urgent for systems without the vulnerable dependency or without attacker-controlled access to the affected function.
Technical view
jsrsasign versions before 11.1.1 are vulnerable to an infinite loop in ext/jsbn2.js bnModInverse / BigInteger.modInverse when given zero or negative inputs. The CVSS 4.0 score is 8.7, with network attack vector, low complexity, no privileges, no user interaction, and high availability impact.
Likely exposure
Exposure is most likely in Node.js or Java WebJars applications using jsrsasign before 11.1.1 where untrusted input can reach BigInteger.modInverse. Applications only using unaffected versions, or not invoking the vulnerable path with attacker-controlled values, have lower practical exposure.
Exploitation context
The source bundle includes a public gist and upstream fix references, but does not establish active exploitation. CISA KEV status is false in the provided data. Exploitation would primarily cause application hang or resource exhaustion rather than confidentiality or integrity compromise.
Researcher notes
Key evidence points to an upstream fix in jsrsasign and Snyk advisories for npm and WebJars packaging. The affected condition is specific: zero or negative inputs to modInverse. The provided data does not prove active exploitation or broader impact beyond denial of service.
Mitigation direction
- Upgrade jsrsasign to version 11.1.1 or later.
- Update org.webjars.npm:jsrsasign where used in Java projects.
- Apply relevant Red Hat errata if using affected Red Hat-packaged software.
- If immediate upgrade is blocked, restrict untrusted inputs reaching modular inverse operations.
- Monitor vendor advisories for product-specific remediation details.
Validation and detection
- Inventory direct and transitive jsrsasign dependencies across npm and Maven projects.
- Flag jsrsasign versions earlier than 11.1.1.
- Review code paths that pass user-controlled values into BigInteger.modInverse.
- Confirm deployed containers and build artifacts contain the remediated dependency.
- Check Red Hat CSAF or errata status for managed platforms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1287: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-835: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-4598 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
3 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P——snykCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P3.93.6snykCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat-SADPVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-03-23T06:01:47.891Z: Reported to Red Hat.
- 2026-03-23T05:00:11.571Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938CVE reference, snyk
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812263CVE reference, snyk
- https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264CVE reference, snyk
- https://github.com/kjur/jsrsasign/pull/648CVE reference, snyk
- https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323CVE reference, snyk
- https://access.redhat.com/security/cve/CVE-2026-4598CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2450210CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4598.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:19409CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19410CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22840CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6720CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6568CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19375CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:23361CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Validation of Specified Type of Input
Improper Validation of Specified Type of Input represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Loop with Unreachable Exit Condition ('Infinite Loop')
Loop with Unreachable Exit Condition ('Infinite Loop') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.