# CVE-2024-14041: Bouncy Castle for Java timing side-channel in ML-KEM

Source: https://junglewise.ai/threats/cve-2024-14041-bouncy-castle-for-java-timing-side-channel-in-ml-kem  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2024-14041 · Severity: info · CVSS 8.2 · Published 2026-07-28

Bouncy Castle for Java, a widely used library for secure communications and data encryption, contains a flaw in its implementation of the ML-KEM (Kyber) algorithm. This vulnerability allows an attacker to potentially recover a server's long-term private encryption key by measuring the time it takes to process a large number of requests. If successful, this would allow the attacker to decrypt sensitive communications or impersonate the affected service.

Technologies: [Legion of the Bouncy Castle Inc. BC-JAVA (bcprov)](https://junglewise.ai/threats/technologies/bc-java). Vendors: [Legion of the Bouncy Castle Inc.](https://junglewise.ai/threats/vendors/legion-of-the-bouncy-castle-inc).

## Quick answers

**Is CVE-2024-14041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-14041 being exploited in the wild.

**How severe is CVE-2024-14041?** Informational severity, with a CVSS score of 8.2, published 28 July 2026.

**Which products and versions are affected?** Legion of the Bouncy Castle Inc. BC-JAVA (bcprov) 1.73 to before 1.78.

**Is there a fix for CVE-2024-14041?** A patch was published: Fixed in Bouncy Castle for Java 1.78 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-14041 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-14041?** Check whether you run Legion of the Bouncy Castle Inc. BC-JAVA (bcprov) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A timing side-channel vulnerability (CWE-208), known as KyberSlash, exists in Bouncy Castle for Java's ML-KEM (CRYSTALS-Kyber) implementation. The routines Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec perform division of secret-derived polynomial coefficients by the modulus q. Because these division operations are not constant-time on many CPU architectures, the execution time varies based on the secret values. A remote attacker who can perform a large number of decapsulations using the same long-term private key and accurately measure the timing differences can statistically recover the private key. The issue was addressed in version 1.78 by implementing constant-time division routines.

## Affected products

- Legion of the Bouncy Castle Inc. BC-JAVA (bcprov) 1.73 to before 1.78

## Timeline

- 2026-07-28: advisory: NVD publication date
- 2024-06-24: other: KyberSlash research published
- patched: Fixed in Bouncy Castle for Java 1.78

## References

- [https://www.bouncycastle.org/download/bouncy-castle-java/](https://www.bouncycastle.org/download/bouncy-castle-java/)
- [https://github.com/bcgit/bc-java/commit/1590247178f2280defa36421475f015175dfbe9e](https://github.com/bcgit/bc-java/commit/1590247178f2280defa36421475f015175dfbe9e)
- [https://github.com/bcgit/bc-java/commit/5adb2c5c5b462a332b01a012bea0784b40b904e5](https://github.com/bcgit/bc-java/commit/5adb2c5c5b462a332b01a012bea0784b40b904e5)
- [https://github.com/bcgit/bc-java/wiki/CVE-2024-14041](https://github.com/bcgit/bc-java/wiki/CVE-2024-14041)
- [https://kyberslash.cr.yp.to/](https://kyberslash.cr.yp.to/)