CVE-2026-21895: Rustcrypto Rsa

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is `1`. Version 0.9.10 fixes the issue.

Affected products

• Rustcrypto Rsa: before 0.9.10 (fixed in 0.9.10)

Published 2026-01-08. Last modified 2026-06-17.