{"cve":"CVE-2023-49092","nvd":{"published":"2023-11-28T21:15:08.530","modified":"2026-06-17T06:35:20.990","status":"Modified","description":"RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is currently no fix available. As a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9},"cwes":["CWE-203","CWE-385"],"references":["https://github.com/RustCrypto/RSA/issues/19#issuecomment-1822995643","https://github.com/RustCrypto/RSA/security/advisories/GHSA-c38w-74pg-36hr","https://github.com/RustCrypto/RSA/issues/19#issuecomment-1822995643","https://github.com/RustCrypto/RSA/security/advisories/GHSA-c38w-74pg-36hr"],"products":["rustcrypto:rsa"],"source":"nvd","synced_at":"2026-10-19T21:42:07.670898610+00:00"},"epss":{"cve":"CVE-2023-49092","score":0.0061,"percentile":0.49229,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4grx-2x9w-596c","url":"https://osv.dev/vulnerability/GHSA-4grx-2x9w-596c","summary":"Marvin Attack: potential key recovery through timing sidechannels","modified":"2026-09-10T03:50:04.002228238Z","packages":[{"ecosystem":"crates.io","name":"rsa","purl":"pkg:cargo/rsa","ranges":["<=0.9.6"],"fixed":[]}]},{"id":"GHSA-c38w-74pg-36hr","url":"https://osv.dev/vulnerability/GHSA-c38w-74pg-36hr","summary":"Marvin Attack: potential key recovery through timing sidechannels","modified":"2026-09-10T03:49:58.927410760Z","packages":[{"ecosystem":"crates.io","name":"rsa","purl":"pkg:cargo/rsa","ranges":["<=0.9.6"],"fixed":[]}]},{"id":"RUSTSEC-2023-0071","url":"https://osv.dev/vulnerability/RUSTSEC-2023-0071","summary":"Marvin Attack: potential key recovery through timing sidechannels","modified":"2026-09-14T09:45:02.996132556Z","packages":[{"ecosystem":"crates.io","name":"rsa","purl":"pkg:cargo/rsa","ranges":[">=0.0.0-0"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}