Cryptographic Implementation Flaw in jsrsasign by KJUR

CVE-2026-4601

What is CVE-2026-4601?

The jsrsasign library, specifically versions prior to 11.1.1, contains a vulnerability in its DSA signing implementation. This flaw allows an attacker to exploit the signing process through the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force the parameters 'r' or 's' to zero, the library produces an invalid signature without attempting a retry. This behavior enables the attacker to derive the private key from the resulting signature, posing a significant risk to cryptographic security. It is essential for users of the library to upgrade to the latest version to mitigate this risk.

References