CVE-2026-4603 | jsrsasign up to 11.1.0 KEYUTIL Parser ext/rsa.js divide by zero (SNYK-JS-JSRSASIGN-15371176)

VDB-352489 · CVE-2026-4603 · GCVE-0-2026-4603 JSRSASIGN UP TO 11.1.0 KEYUTIL PARSER EXT/RSA.JS DIVIDE BY ZERO HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.5 $0-$5k 2.88+ Summaryinfo A vulnerability marked as problematic has been reported in jsrsasign up to 11.1.0. Impacted is an unknown function of the file ext/rsa.js of the component KEYUTIL Parser. This manipulation causes divide by zero. The identification of this vulnerability is CVE-2026-4603. The attack can only be executed locally. There is no exploit available. It is suggested to upgrade the affected component. Detailsinfo A vulnerability has been found in jsrsasign up to 11.1.0 and classified as problematic. Affected by this vulnerability is an unknown code of the file ext/rsa.js of the component KEYUTIL Parser. The manipulation with an unknown input leads to a divide by zero vulnerability. The CWE definition for the vulnerability is CWE-369. The product divides a value by zero. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is: Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero. The advisory is shared at security.snyk.io. This vulnerability is known as CVE-2026-4603 since 03/22/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. It is declared as proof-of-concept. Upgrading to version 11.1.1 eliminates this vulnerability. Productinfo Name jsrsasign Version 11.0 11.1.0 CPE 2.3info 🔒 🔒 CPE 2.2info 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA CVSS-B Score: 🔒 CNA CVSS-BT Score: 🔒 CNA Vector: 🔒 CVSSv3info VulDB Meta Base Score: 5.6 VulDB Meta Temp Score: 5.5 VulDB Base Score: 5.3 VulDB Temp Score: 5.1 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 5.9 CNA Vector (snyk): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Divide by zero CWE: CWE-369 / CWE-404 CAPEC: 🔒 ATT&CK: 🔒 Physical: Partially Local: Yes Remote: No Availability: 🔒 Status: Proof-of-Concept Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: jsrsasign 11.1.1 Timelineinfo 03/22/2026 CVE reserved 03/23/2026 +1 days Advisory disclosed 03/23/2026 +0 days VulDB entry created 03/23/2026 +0 days VulDB entry last update Sourcesinfo Advisory: SNYK-JS-JSRSASIGN-15371176 Status: Confirmed CVE: CVE-2026-4603 (🔒) GCVE (CVE): GCVE-0-2026-4603 GCVE (VulDB): GCVE-100-352489 Entryinfo Created: 03/23/2026 07:18 Changes: 03/23/2026 07:18 (78) Complete: 🔍 Cache ID: 99:AF1:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸