CVE-2026-21895: 
Rust vulnerability analysis and mitigation

CVE-2026-21895 is a denial-of-service vulnerability in the rsa Rust crate (RustCrypto/RSA) caused by an unhandled panic when constructing an RSA private key with a prime component equal to 1. Affected versions are all releases up to and including 0.9.9; version 0.9.10 resolves the issue. The vulnerability was discovered by Christian Reitter from Radically Open Security during a security review for Proton AG and was publicly disclosed on January 6, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 score of 2.7 (Low) (Github Advisory, RustCrypto Advisory).

The root cause is classified as CWE-703 (Improper Check or Handling of Exceptional Conditions). In src/key.rs, the validation logic for RSA private key primes used a strict less-than comparison (*prime < BigUint::one()) rather than a less-than-or-equal comparison, meaning a prime value of exactly 1 passed validation and later caused a divide-by-zero panic during key operations. The fix in commit 2926c91 corrects the condition to *prime <= BigUint::one(), causing the function to return an Error::InvalidPrime instead of panicking. An attacker capable of supplying crafted RSA key components to an application using this crate — for example, via a network-accessible key import or parsing endpoint — could trigger the panic remotely without authentication (RustCrypto Commit, Github Advisory).

Successful exploitation causes the affected Rust application to panic and crash, resulting in a loss of availability for any service relying on the rsa crate for private key construction. There is no impact on confidentiality or integrity — the vulnerability cannot be used to extract key material or modify data. The scope is limited to the vulnerable system itself, with no lateral movement potential inherent to this flaw (Github Advisory, RustCrypto Advisory).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.042% (4th percentile), indicating a very low probability of exploitation in the near term. The exploit maturity is rated "Unreported" and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to supply crafted RSA key components (e.g., a prime equal to 1) to an application that processes externally provided key material (Github Advisory).

1. Identify target: Locate a network-accessible application or service that uses the rsa Rust crate (versions ≤ 0.9.9) and accepts externally supplied RSA private key components (e.g., via a key import, parsing, or configuration endpoint).
2. Craft malicious key: Construct an RSA private key structure where one of the prime factors (p or q) is set to the value 1. This is an invalid prime but was not rejected by the vulnerable validation logic.
3. Submit the crafted key: Send the malformed key to the target application through whatever interface accepts RSA key material (e.g., API endpoint, file upload, TLS client certificate, configuration file).
4. Trigger panic: When the application calls RsaPrivateKey::from_components() with the crafted input, the internal arithmetic operations encounter a divide-by-zero condition, causing the Rust runtime to panic and the application process to crash.
5. Achieve denial of service: The application becomes unavailable until it is restarted, and repeated submissions can maintain the denial-of-service condition (RustCrypto Commit, RustCrypto Advisory).

• Logs: Application logs showing an unexpected Rust panic message such as thread 'main' panicked or attempt to divide by zero originating from the rsa crate's key construction code path (src/key.rs).
• Process: Sudden, unexpected termination of a Rust application process that handles RSA key material, potentially with a non-zero exit code corresponding to a panic.
• Network: Repeated submissions of RSA key data (e.g., PEM-encoded private keys or DER-encoded structures) to a key import or parsing endpoint, particularly from unexpected or external sources, coinciding with application crashes.

Upgrade the rsa crate to version 0.9.10 or later, which corrects the prime validation logic to properly reject primes equal to 1 by returning Error::InvalidPrime instead of panicking. Update your Cargo.toml dependency to specify rsa = "0.9.10" or higher and rebuild the application. No configuration-based workaround is available; upgrading is the only remediation. Applications that do not accept externally supplied RSA key components have significantly reduced exposure (Github Advisory, RustCrypto Commit).

The vulnerability was discovered during a professional security review of Proton AG's codebase by Christian Reitter of Radically Open Security, reflecting the value of third-party security audits for open-source cryptographic libraries. The advisory was rated Low severity by the maintainers, and community reaction has been minimal given the narrow exploitation conditions and limited impact. No significant media coverage or notable researcher commentary beyond the advisory itself has been identified (RustCrypto Advisory).