CVE-2026-2739

medium Red Hat
CVSS v3 Base Score
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: February 20, 2026
Last Modified: February 20, 2026
Vendor: Red Hat

Description

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

CWE

CWE-835

Affected Products

Logging Subsystem for Red Hat OpenShiftOpenShift PipelinesOpenShift Service Mesh 2OpenShift Service Mesh 3Red Hat 3scale API Management Platform 2Red Hat build of Apicurio Registry 2Red Hat Developer HubRed Hat Enterprise Linux 8Red Hat Enterprise Linux 9Red Hat Fuse 7

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 gist.github.com 🔗 github.com