CVE-2025-45764

Published: Aug 6, 2025Modified: Jun 17, 2026Deferred

3.2

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Exploitability: 1.4 / Impact: 1.4

Source: MITRE (Secondary)

Description

jsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs can be assigned for key lengths in specific applications that use a library, and should not be assigned to the default key lengths in a library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (2)

https://gist.github.com/ZupeiNie/2250cf1758771d56272dc326ce066202

Source: cve@mitre.org

https://github.com/kjur/jsrsasign/issues/634

Source: cve@mitre.org

Timeline

No history available yet.