GHSA-7587-4WV6-M68M: Panic at the Keyring: Crashing rPGP with a Single Byte

Panic at the Keyring: Crashing rPGP with a Single Byte

Vulnerability ID: GHSA-7587-4WV6-M68M
CVSS Score: 7.5
Published: 2026-02-13

In the world of safe systems programming, Rust is the golden child. It promises to save us from the memory corruption sins of C and C++. But while Rust protects memory, it doesn't protect logic. A critical denial-of-service vulnerability was discovered in the rPGP library (and its dependency, the rsa crate) where a mathematically impossible RSA key component triggers a hard panic. By setting a prime factor to '1', an attacker can trick the underlying arithmetic engine into a division-by-zero scenario, crashing any application attempting to parse the key. This is a story about how 'safe' languages still need defensive coding.

TL;DR

The rPGP library (via the rsa crate < 0.9.10) contains a logic flaw in validating RSA private key components. By providing a crafted Secret Key Packet where one of the prime factors is set to 1, the library attempts to calculate modulus inverses using (p-1), resulting in a division-by-zero panic. This crashes the application process, leading to a Denial of Service (DoS) against keyservers, email clients, or signing services using the library.

---

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-21895
• CWE ID: CWE-703 (Unhandled Exception)
• CVSS: 7.5 (High)
• Attack Vector: Network
• Impact: Denial of Service (Process Crash)
• Root Cause: Division by Zero Panic

Affected Systems

• Rust applications using rPGP crate
• Rust applications using rsa crate directly (< 0.9.10)
• OpenPGP Keyservers based on rPGP
• Secure email gateways using Rust backends
• rsa: < 0.9.10 (Fixed in: 0.9.10)
• pgp: < 0.14.0 (Fixed in: Dependent on rsa update)

Code Analysis

Commit: 2926c91

Fixed validation of primes in RsaPrivateKey to reject 1

- if *prime < BigUint::one() {
+ if *prime <= BigUint::one() {

Commit: 38efa49

Bump rsa dependency to 0.9.10

- rsa = { version = "0.9.9" }
+ rsa = { version = "0.9.10" }

Exploit Details

• GitHub: Original issue report demonstrating the panic with p=1

Mitigation Strategies

• Update dependency tree
• Implement panic handlers (catch_unwind)
• Input sanitization

Remediation Steps:

1. Run cargo update -p rsa to upgrade to version 0.9.10 or later.
2. Recompile any applications attempting to use the pgp crate.
3. Audit code for other instances of BigUint usage where 1 or 0 might cause division errors.

References

• RustSec Advisory
• rPGP Repository

---

Read the full report for GHSA-7587-4WV6-M68M on our website for more details including interactive diagrams and full exploit analysis.