Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-33891 · Microsoft / collected KEV context

EUVD-2026-16833

GHSA-5m6q-g25r-mvwx

cve-program · CVE-2026-33891

• https://github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx
• https://github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023

euvd · EUVD-2026-16833

• https://github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx
• https://github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023

nvd · CVE-2026-33891

• https://github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx
• https://access.redhat.com/errata/RHSA-2026:13826
• https://access.redhat.com/errata/RHSA-2026:24761
• https://access.redhat.com/errata/RHSA-2026:24762
• https://access.redhat.com/errata/RHSA-2026:34342
• https://access.redhat.com/errata/RHSA-2026:9742
• https://access.redhat.com/security/cve/CVE-2026-33891
• https://bugzilla.redhat.com/show_bug.cgi?id=2452450
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33891.json

osv · GHSA-5m6q-g25r-mvwx

• https://github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx
• https://nvd.nist.gov/vuln/detail/CVE-2026-33891
• https://github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023
• https://github.com/digitalbazaar/forge

No related operational record is retained in the current change model.