medium5.3
CVE-2026-21895
rsa crate has potential panic on a prime being equal to 1
Impact
When creating a RSA private key from its components, the construction panics, instead of returning an error, when one of the primes is `1`. Discovered by Christian Reitter from [Radically Open Security](https://www.radicallyopensecurity.com/) during a security review for [Proton AG](https://proton.me/).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | rsa | <= 0.9.9 | 0.9.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rustcrypto | Rsa | before 0.9.10 |