GHSA-9c48-w39g-hm26: rsa fixed in 0.9.10

GHSA-9c48-w39g-hm26 PUBLISHED CVSS 5.300000190734863 MEDIUM

Duplicate

Record from GitHub Advisory Database · Published January 6, 2026

rsa is fixed in 0.9.10 (crates.io)

Duplicate

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
rsa	crates.io	0.9.10
sccache	Wolfi	0.12.0-r1
deno	Wolfi	2.6.4-r1
uv	Chainguard	0.9.27-r4
deno	Chainguard	2.6.4-r1
zed	Wolfi	0.218.6-r0
sqlx	Wolfi	0.8.6-r2
uv	Wolfi	0.9.27-r4
yara-x	Chainguard	1.10.0-r1
lychee	Wolfi	0.22.0-r1
lychee	Chainguard	0.22.0-r1
vector	Wolfi	0.55.0-r0

9 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

5.300000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Vendor	Product	Versions
wolfi	sccache	0
wolfi	deno	0
chainguard	uv	0
crates.io	rsa	0
chainguard	deno	0
wolfi	zed	0
wolfi	sqlx	0
wolfi	uv	0
chainguard	yara-x	0
wolfi	lychee	0
chainguard	lychee	0
wolfi	vector	0
wolfi	qdrant	0
wolfi	atuin	0
chainguard	qdrant	0
chainguard	sqlx	0
chainguard	atuin	0
chainguard	vector	0
chainguard	sccache	0
wolfi	yara-x	0

…and 1 more

Timeline

Jan 6, 2026 CVE Published
Mar 17, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-9c48-w39g-hm26
vulnetix vdb fixes GHSA-9c48-w39g-hm26

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-9c48-w39g-hm26/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →