CVE-2026-4603: Divide by Zero
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 11.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4603?
CVE-2026-4603 is considered a moderate severity vulnerability due to its potential impact on RSA public-key operations.
How do I fix CVE-2026-4603?
To fix CVE-2026-4603, upgrade the jsrsasign package to version 11.1.1 or later.
Who is affected by CVE-2026-4603?
CVE-2026-4603 affects versions of the jsrsasign package prior to 11.1.1.
What types of attacks can exploit CVE-2026-4603?
CVE-2026-4603 can be exploited to disrupt RSA public-key operations such as verification and encryption.
Where can I find more information about CVE-2026-4603?
For more information about CVE-2026-4603, refer to the security advisories and changelogs associated with the jsrsasign package.