Vulnerability · Published Aug 6, 2025 · Assigned by mitre
CVE-2025-45764
Low 3.2
In plain English
A low-severity security flaw in jsrsasign from jsrsasign project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Official description
jsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs can be assigned for key lengths in specific applications that use a library, and should not be assigned to the default key lengths in a library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jsrsasign project | jsrsasign | 11.1.0 |
Weakness: CWE-326 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N