Swift Crypto 4.5.1 fixes RSA public-key double-free

Swift Crypto 4.5.1 patches a double-free that could crash applications when RSA public key parsing fails, tracked as CVE-2026-43823.

The flaw sits in initialization of RSA public keys from DER or PEM bytes. On a failed parse, the underlying key object was released twice, once during error handling and again when the wrapper was torn down. A later memory allocation could then crash the process. Any code that feeds untrusted material into the library’s RSA signing, encryption, or blind-signing public key types is in scope.

Affected releases run from 3.2.0 through 4.5.0. The fix shipped in 4.5.1 on 16 July 2026; users who already upgraded need take no further action. Others should move to 4.5.1 as soon as practical.

Sujal Tuladhar reported the issue.