GHSA-9c48-w39g-hm26
NoneCVSS
—
EPSS
—
Published
Jan 6, 2026
CISA due date
—
The record
rsa crate has potential panic on a prime being equal to 1
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | rsa | 0 | 0.9.10 |
| Chainguard | atuin | 0 | 18.10.0-r1 |
| Chainguard | deno | 0 | 2.6.4-r1 |
| Chainguard | lychee | 0 | 0.22.0-r1 |
| Chainguard | qdrant | 0 | 1.16.3-r1 |
| Chainguard | sccache | 0 | 0.12.0-r1 |
| Chainguard | sqlx | 0 | 0.8.6-r2 |
| Chainguard | yara-x | 0 | 1.10.0-r1 |
| Chainguard | zed | 0 | 0.217.4-r1 |
| Chainguard | zed | 0 | 0.218.6-r0 |
| Wolfi | atuin | 0 | 18.10.0-r1 |
| Wolfi | deno | 0 | 2.6.4-r1 |
| Wolfi | lychee | 0 | 0.22.0-r1 |
| Wolfi | qdrant | 0 | 1.16.3-r1 |
| Wolfi | sccache | 0 | 0.12.0-r1 |
| Wolfi | sqlx | 0 | 0.8.6-r2 |
| Wolfi | yara-x | 0 | 1.10.0-r1 |
| Wolfi | zed | 0 | 0.217.4-r1 |
| Wolfi | zed | 0 | 0.218.6-r0 |
Related vulnerabilities
- CVE-2026-21895 The `rsa` crate is an RSA implementation written in rust. Same vulnerability
- CVE-2023-49092 RustCrypto/RSA is a portable RSA implementation in pure Rust. Also affects rsa
- CVE-2026-25727 time provides date and time handling in Rust. Also affects atuin
- CVE-2026-25541 Bytes is a utility library for working with bytes. Also affects atuin
- CVE-2024-12224 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded Also affects atuin
- CVE-2024-47609 Tonic is a native gRPC client & server implementation with async/await support. Also affects atuin
- CVE-2026-33056 tar-rs is a tar archive reading/writing library for Rust. Also affects deno
- CVE-2026-33055 tar-rs is a tar archive reading/writing library for Rust. Also affects deno