Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 17 September 2026.

Which products and versions are affected?

Argyle Software Pqc Kyber all versions including 0.7.1; pqc_kyber (crates.io) SEMVER:introduced=0.0.0-0.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Check whether you run Argyle Software Pqc Kyber or pqc_kyber (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

pqc_kyber Rust library unmaintained with unpatched flaw

Severity: info · Published 2026-09-17

The pqc_kyber Rust library, which implements post-quantum cryptography for securing communications, has not been updated since August 2023 and is no longer maintained by its developers. An unpatched vulnerability exists in the AVX2 hardware-accelerated backend that could allow attackers to recover encryption keys through a chosen-ciphertext attack. Applications using this library for cryptographic protection are at risk of data exposure if the vulnerable code paths are exercised.

Technologies: pqc_kyber (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 17 September 2026.
Which products and versions are affected?: Argyle Software Pqc Kyber all versions including 0.7.1; pqc_kyber (crates.io) SEMVER:introduced=0.0.0-0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected?: Check whether you run Argyle Software Pqc Kyber or pqc_kyber (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

pqc_kyber is an unmaintained Rust implementation of ML-KEM (Kyber) post-quantum cryptography. A chosen-ciphertext key-recovery flaw exists in the AVX2 backend, with a fix proposed in an open pull request (Argyle-Software/kyber#121) that has not been reviewed or merged. The maintainer is unresponsive and no patched versions have been released since 0.7.1 (2023-08-23).

Affected products

Argyle Software pqc_kyber all versions including 0.7.1

Timeline

2026-09-17: disclosed: Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.