The vulnerability lies in the RustCrypto RSA crate, an RSA implementation in Rust. In releases prior to 0.9.10, constructing a private key from its components triggers a panic when one of the primes equals 1, instead of returning an error. This panic abruptly terminates the host process, effectively causing a denial of service.

All versions of the RustCrypto RSA crate older than 0.9.10 are affected, regardless of other dependencies. The fix is shipped in version 0.9.10 and later, where prime‑equals‑one is handled safely without panic.

The CVSS score of 2.7 categorizes the issue as low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, further reducing its relevance. Exploitation would require an attacker to supply key parameters that contain a prime of 1, a condition that is unlikely to arise in normal use but could be forced in a malicious payload or via dependency injection, leading to a process crash but not to arbitrary code execution.