CVE-2026-2739

medium Red Hat
CVSS v3 Base Score
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
0.0%
Exploitation probability in 30 days
Top 95% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Published: February 20, 2026 (83 days ago)
Last Modified: February 20, 2026
Vendor: Red Hat

Description

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

CWE

CWE-835

Affected Products

Logging Subsystem for Red Hat OpenShiftOpenShift PipelinesOpenShift Service Mesh 2OpenShift Service Mesh 3Red Hat 3scale API Management Platform 2Red Hat build of Apicurio Registry 2Red Hat Developer HubRed Hat Enterprise Linux 8Red Hat Enterprise Linux 9Red Hat Fuse 7

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 gist.github.com 🔗 github.com