diff --git a/library/psa_crypto_rsa.c b/library/psa_crypto_rsa.c
index 170774ee1a..322ede0701 100644
--- a/library/psa_crypto_rsa.c
+++ b/library/psa_crypto_rsa.c
@@ -658,15 +658,23 @@ psa_status_t mbedtls_psa_asymmetric_decrypt(const psa_key_attributes_t *attribut
                 output_length, input, output, output_size);
 
             /* We want to convert ret into a psa status without allowing an
-             * attacker to distinguish between 0 and invalid padding. Since
-             * mbedtls_psa_error() is leaky, hide the difference from it. */
+             * attacker to distinguish between 0, invalid padding, or buffer too
+             * small. (It's OK if the attacker distinguishes between one of the
+             * above three and other status such as out of memory.) Since
+             * mbedtls_to_psa_error() is leaky, hide the difference from it. */
             mbedtls_ct_condition_t bad_padding = mbedtls_ct_uint_eq(
                 (mbedtls_ct_uint_t) ret,
                 (mbedtls_ct_uint_t) MBEDTLS_ERR_RSA_INVALID_PADDING);
+            mbedtls_ct_condition_t large_msg = mbedtls_ct_uint_eq(
+                (mbedtls_ct_uint_t) ret,
+                (mbedtls_ct_uint_t) MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE);
             ret = mbedtls_ct_error_if(bad_padding, 0, ret);
+            ret = mbedtls_ct_error_if(large_msg, 0, ret);
             status = mbedtls_to_psa_error(ret);
             status = mbedtls_ct_error_if(bad_padding,
                                          PSA_ERROR_INVALID_PADDING, status);
+            status = mbedtls_ct_error_if(large_msg,
+                                         PSA_ERROR_BUFFER_TOO_SMALL, status);
 #else
             status = PSA_ERROR_NOT_SUPPORTED;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */