CVE-2026-4600
EUVD-2026-1437523.03.2026, 06:16
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| kjur | jsrsasign | 𝑥 < 11.1.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Migration Toolkit for Virtualization 2.1 | 1779139872 ≤ 𝑥 < * | ADP |
| Red Hat | Migration Toolkit for Virtualization 2.9 | 1778927462 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.1 | 1775169155 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1775253092 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.15 | 1775169219 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.16 | 1779204086 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.9 | 1775169218 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
References