This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

🔗 CVE IDs covered (1)

🎯 Affected products2

• cbl2 reaper 3.1.1-22 on CBL Mariner 2.0
• cbl2 reaper 3.1.1-22 on CBL-Mariner 2.0

✅ Remediation

KBCBL-Mariner Releases (Security Update) — fixed build 3.1.1-23 KBRelease Notes (Security Update) — fixed build 3.1.1-23

🔗 References (2)

• advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-2739
• referencehttps://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade