CVE-2026-21895CWE-703

rsa crate has potential panic on a prime being equal to 1

Low · published January 8, 2026

CVSS v4.0
2.7
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is `1`. Version 0.9.10 fixes the issue.

The record
Technical detail
CVSS v4.0
2.7 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
EPSS
0.00444 · 37.6th percentile
Weakness
CWE-703 · Improper Check or Handling of Exceptional Conditions
Published
2026-01-08T14:06Z
EPSS history
Timeline
  • 08 JAN 14:06Z
    rsa crate has potential panic on a prime being equal to 1
    cvelistv5