CVE-2026-21895
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Jan 8, 2026
CISA due date
—
The record
The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is `1`. Version 0.9.10 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | rsa | 0 | 0.9.10 |
| Chainguard | atuin | 0 | 18.10.0-r1 |
| Chainguard | deno | 0 | 2.6.4-r1 |
| Chainguard | lychee | 0 | 0.22.0-r1 |
| Chainguard | qdrant | 0 | 1.16.3-r1 |
| Chainguard | sccache | 0 | 0.12.0-r1 |
| Chainguard | sqlx | 0 | 0.8.6-r2 |
| Chainguard | yara-x | 0 | 1.10.0-r1 |
| Chainguard | zed | 0 | 0.217.4-r1 |
| Chainguard | zed | 0 | 0.218.6-r0 |
| Wolfi | atuin | 0 | 18.10.0-r1 |
| Wolfi | deno | 0 | 2.6.4-r1 |
| Wolfi | lychee | 0 | 0.22.0-r1 |
| Wolfi | qdrant | 0 | 1.16.3-r1 |
| Wolfi | sccache | 0 | 0.12.0-r1 |
| Wolfi | sqlx | 0 | 0.8.6-r2 |
| Wolfi | yara-x | 0 | 1.10.0-r1 |
| Wolfi | zed | 0 | 0.217.4-r1 |
| Wolfi | zed | 0 | 0.218.6-r0 |
| openSUSE:Tumbleweed | teleport | 0 | 17.7.14-1.1 |
Related vulnerabilities
- GHSA-9c48-w39g-hm26 rsa crate has potential panic on a prime being equal to 1 Same vulnerability
- CVE-2023-49092 RustCrypto/RSA is a portable RSA implementation in pure Rust. Also affects rsa
- CVE-2026-25727 time provides date and time handling in Rust. Also affects atuin
- CVE-2026-25541 Bytes is a utility library for working with bytes. Also affects atuin
- CVE-2024-12224 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded Also affects atuin
- CVE-2024-47609 Tonic is a native gRPC client & server implementation with async/await support. Also affects atuin
- CVE-2026-33056 tar-rs is a tar archive reading/writing library for Rust. Also affects deno
- CVE-2026-33055 tar-rs is a tar archive reading/writing library for Rust. Also affects deno