A critical infinite loop vulnerability in the jsrsasign library allows unauthenticated remote attackers to trigger a denial of service by causing the application process to hang.

This is an infinite loop vulnerability (CWE-835) occurring within the bnModInverse function of the ext/jsbn2.js file. An unauthenticated attacker can supply crafted zero or negative values to this function to cause the application process to enter an infinite loop, resulting in a permanent denial of service.

The exploitation of this flaw leads to a complete denial of service for any application relying on the affected jsrsasign library for cryptographic operations. Given the CVSS score of 7.5, this high severity vulnerability poses a significant risk to system availability and uptime. Successful attacks can cause service outages, disrupt business-critical workflows, and necessitate manual intervention to restart impacted services.

Immediate Action: Update the jsrsasign package to version 11.1.1 or later to incorporate the necessary input validation fixes.

Proactive Monitoring: Monitor server CPU and process utilization metrics for unexpected spikes or processes that remain in a perpetual running state without completion.

Compensating Controls: Implement input validation at the application level to reject zero or negative values before they reach the cryptographic processing layer, and utilize rate limiting to mitigate the impact of potential automated exploitation.

Public Exploit Available: Yes — a public proof-of-concept exists, attributed to the security researcher's write-up referenced in the vulnerability details.

Due to the high potential for service disruption and the availability of a public proof-of-concept, organizations should prioritize the update of the jsrsasign library to version 11.1.1. Failure to address this vulnerability leaves critical infrastructure exposed to denial of service attacks that can be automated by remote, unauthenticated actors. Immediate patching is the most effective method to eliminate this risk.