CVE-2026-4599
EUVD-2026-1437323.03.2026, 06:16
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| kjur | jsrsasign | 7.0.0 ≤ 𝑥 < 11.1.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Migration Toolkit for Virtualization 2.1 | 1779139872 ≤ 𝑥 < * | ADP |
| Red Hat | Migration Toolkit for Virtualization 2.9 | 1778927462 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.1 | 1775169155 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1775253092 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.15 | 1775169219 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.16 | 1779204086 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.9 | 1775169218 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
- CWE-1023 - Incomplete Comparison with Missing FactorsThe software performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
References