CVE-2025-45764 Weak cryptography in jsrsasign
The jsrsasign library uses weak encryption key lengths, potentially allowing attackers to decrypt sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-45764?
CVE-2025-45764 is a low-severity vulnerability in jsrsasign, published on 6 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
jsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs can be assigned for key lengths in specific applications that use a library, and should not be assigned to the default key lengths in a library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
Weakness: CWE-326
Which versions are affected by CVE-2025-45764?
How do I fix CVE-2025-45764?
No fix has been published for CVE-2025-45764 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-45764 being exploited?
There is no known exploitation of CVE-2025-45764 in the wild and no public exploit code.
Sources
Also known as GHSA-qw4m-3r5p-h4wq.