Executive brief
The pqc_kyber Rust library, which implements post-quantum cryptography for securing communications, has not been updated since August 2023 and is no longer maintained by its developers. An unpatched vulnerability exists in the AVX2 hardware-accelerated backend that could allow attackers to recover encryption keys through a chosen-ciphertext attack. Applications using this library for cryptographic protection are at risk of data exposure if the vulnerable code paths are exercised.
Technical details
pqc_kyber is an unmaintained Rust implementation of ML-KEM (Kyber) post-quantum cryptography. A chosen-ciphertext key-recovery flaw exists in the AVX2 backend, with a fix proposed in an open pull request (Argyle-Software/kyber#121) that has not been reviewed or merged. The maintainer is unresponsive and no patched versions have been released since 0.7.1 (2023-08-23).
Affected products
- Argyle Software pqc_kyber all versions including 0.7.1
Timeline
- 2026-09-17: disclosed: Advisory published