Process hang via unnormalized modular-inverse input

Infinite loop in jsrsasign before 11.1.1 allows remote attackers to hang an embedding process through crafted modular-inverse inputs. The bnModInverse function in ext/jsbn2.js initializes its binary inversion loop with the original zero or negative BigInteger instead of rejecting zero and reducing negative values modulo the modulus, so the loop never reaches its exit condition. Exploitation requires an embedding application to pass attacker-controlled values to BigInteger.modInverse; the affected process remains hung until it is externally terminated.