Incomplete Comparison Vulnerability in jsrsasign by KJUR

CVE-2026-4599

What is CVE-2026-4599?

The jsrsasign library from KJUR is susceptible to an Incomplete Comparison vulnerability in its methods getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax. This flaw allows attackers to exploit imprecise checks in key comparison processes, particularly during Digital Signature Algorithm (DSA) nonce generation. By accepting out-of-range values, the vulnerability can lead to an opportunity for unauthorized access, potentially allowing an attacker to recover the private key. It is critical for users to evaluate their security posture in context of this issue and implement recommended updates.

References