GHSA-9c48-w39g-hm26

rsa crate has potential panic on a prime being equal to 1

Source: GitHub Advisory Database (reviewed) Low CVE-2026-21895

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	rsa	< 0.9.10	0.9.10

Details

As written in the advisory (Markdown source, shown as plain text).

When creating a RSA private key from its components, the construction panics, instead of returning an error, when one of the primes is `1`. Discovered by Christian Reitter from [Radically Open Security](https://www.radicallyopensecurity.com/) during a security review for [Proton AG](https://proton.me/).

References

External links from the advisory. They lead to third-party sites.

https://github.com/RustCrypto/RSA/security/advisories/GHSA-9c48-w39g-hm26 web
https://nvd.nist.gov/vuln/detail/CVE-2026-21895 advisory
https://github.com/RustCrypto/RSA/commit/2926c91bef7cb14a7ccd42220a698cf4b1b692f7 web
https://github.com/RustCrypto/RSA package