Bug 2441279 (CVE-2026-2739)

Summary: CVE-2026-2739 bn.js: bn.js: Denial of Service via calling maskn(0)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, akostadi, alizardo, amasferr, bdettelb, caswilli, chfoley, dhanak, dmayorov, doconnor, drosa, eric.wittmann, gmalinko, ibek, janstey, jcantril, jchui, jhe, jlledo, jrokos, jscholz, kaycoth, ktsao, kverlaen, lchilton, mnovotny, nboldt, nipatil, pantinor, pdelbell, pjindal, psrna, rkubis, rojacob, rstepani, sausingh, sdawley, sfeifer, swoodman, teagle, tsedmik
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in bn.js. When calling the `maskn(0)` function on a BN instance, there is potential for this action to corrupt the internal state of the library, causing critical methods such as `toString()` and `divmod()` to enter an infinite loop. The primary consequence is a Denial of Service (DoS), where the affected process hangs indefinitely.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-02-20 06:01:33 UTC 
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.