CVE-2026-21895: rustcrypto rsa
CVSS: 5.3v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-21895DEBIAN-CVE-2026-21895CGA-3wwp-73f3-65cpCGA-4c6x-6969-rgxwCGA-53px-7j9v-x865CGA-64q6-jqv4-gwp2CGA-675x-wqgm-987vCGA-68fp-pjh3-gmpcCGA-68mf-hcc7-pvgcCGA-6mvq-g2w2-h22wCGA-6p5r-5h5g-gv94CGA-83g3-r5f4-rq5gCGA-9c6f-gv8x-29rhCGA-9mfh-4frp-j924CGA-c8r8-q5pp-pxcfCGA-hqcm-7fvv-phvrCGA-hv3q-j74h-9m29CGA-mm9f-5jp2-hf7vCGA-pqv2-3qqv-r2qfCGA-q29c-9x7h-qp6mCGA-qh8q-hpp5-v7f3CGA-rx72-wfwm-8qwmCGA-v262-8xx8-jcc2CGA-v6m6-2vf3-55fvCGA-w7r2-5f5m-r48jCGA-xh52-86vv-vfjhopenSUSE-SU-2026:10105-1GHSA-9c48-w39g-hm26
Published 08-01-2026Last modified 08-01-2026
Vulnerability summary
CVE-2026-21895 is a medium (CVSS 5.3) vulnerability in rustcrypto rsa. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.2% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
0.44%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 08-01-2026PublishedVulnerability first disclosed.
- 08-01-2026Last modifiedVulnerability information updated.
Description
The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is `1`. Version 0.9.10 fixes the issue.
CVSS metrics
9 scores · 7 sources · 2 versionsLow 2.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:USources6 sources · 2.7–6.9
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UDiffers
- OSV · Crates.ioEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST2.7LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
-0.01 pp
From 0.45% on 19-09-2026
19-09-202619-10-2026
EPSS score0.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard10 products
- atuin< 18.10.0-r1
- deno< 2.6.4-r1
- lychee< 0.22.0-r1
- qdrant< 1.16.3-r1
- sccache< 0.12.0-r1
Wolfi10 products
- atuin< 18.10.0-r1
- deno< 2.6.4-r1
- lychee< 0.22.0-r1
- qdrant< 1.16.3-r1
- sccache< 0.12.0-r1
Crates.Io1 product
- rsa< 0.9.10
Debian1 product
- rust-rsaAll versions (No fix recorded) | < 0.9.10-1
Opensuse1 product
- teleport&distro=openSUSE Tumbleweed< 17.7.14-1.1
Rustcrypto1 product
- rsa< 0.9.10
Ubuntu1 product
- rust-rsaAll versions (No fix recorded)
7 vendors · 25 products
References
9 links- github.com/RustCrypto/RSA/security/advisories/GHSA-9c48-w39g-hm26X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
- github.com/RustCrypto/RSA/commit/2926c91bef7cb14a7ccd42220a698cf4b1b692f7X Refsource MISCREPORTFIXWEBPatch
- github.com/RustCrypto/RSAPACKAGE