CVE-2024-14041

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions 1.73 through 1.77

Description Three ML-KEM (CRYSTALS-Kyber) routines perform non-constant-time division of secret-derived polynomial coefficients by the modulus q. The affected routines are Poly.toMsg(), which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly() and PolyVec.compressPolyVec(). This issue, known as KyberSlash, allows an attacker to recover a long-term private key by measuring the timing of a large number of decapsulations performed with that key. Compression during encapsulation is not affected as it operates on values that become public ciphertext.

Recommendations Update Bouncy Castle for Java to version 1.78 or later.