PT-2026-2125 · Rsa+1 · Rsa+1

Invd · Published 2026-01-06 · Updated 2026-03-12 · CVE-2026-21895

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions rsa crate versions prior to 0.9.10

Description The rsa crate, an RSA implementation written in rust, experiences a panic instead of returning an error during the creation of an RSA private key from its components when one of the prime numbers is equal to 1. This issue occurs in versions prior to 0.9.10.

Recommendations Update to rsa crate version 0.9.10 or later.

Exploit

Fix

Weakness Enumeration

CWE-703

Related Identifiers

CVE-2026-21895

GHSA-9C48-W39G-HM26

OPENSUSE-SU-2026:10105-1

Affected Products

Debian

Rsa

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21895.json · Exploit
• https://github.com/RustCrypto/RSA/commit/2926c91bef7cb14a7ccd42220a698cf4b1b692f7 · Patch
• https://github.com/RustCrypto/RSA/security/advisories/GHSA-9c48-w39g-hm26 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9c48-w39g-hm26 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-21895 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21895 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21895 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-21895 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10105-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21895 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-21895 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21895 · Vendor Advisory
• https://github.com/RustCrypto/RSA · Note
• https://t.me/CVEtracker/41721 · Telegram Post
• https://t.me/cveNotify/155345 · Telegram Post