RUSTSEC-2026-0290
Vulnerability from osv_rustsec – Published: 2026-08-16 12:00 – Updated: 2026-09-18 09:06 – Source websiteSummary
When pqc_kyber is built with the opt-in avx2 feature on x86_64, its
constant-time conditional-move routine cmov is a no-op: it never performs the
copy. That cmov is exactly the step that applies the Fujisaki-Okamoto (FO)
implicit rejection during decapsulation. With it disabled, decapsulating an
invalid ciphertext no longer returns a key-independent pseudorandom value;
it returns a value that depends on the decrypted plaintext of the
attacker-chosen ciphertext. This restores the chosen-ciphertext decryption
oracle that the FO transform exists to remove, and yields full recovery of the
static secret key.
The attack requires no timing measurement, no side channel, and no faults; only the ability to submit ciphertexts to a decapsulation operation under a reused key pair and observe the resulting shared secret. See the linked pull request for the root cause, the reachable call path, and reproduction details.
Affected configuration
Reachable only in builds with features = ["avx2"] on an x86_64 target. The
default (reference) backend and all non-x86_64 targets are unaffected.
Impact
Complete IND-CCA break. The plaintext-checking oracle drives a standard chosen-ciphertext key-recovery attack and extracts the entire static secret key. Any protocol reusing a Kyber key pair across decapsulations (static or long-term KEM keys, KEMTLS, HPKE recipients, pinned keys) is exposed; ephemeral-only key shares are not. The defect was verified end to end on ML-KEM-768: the full secret key was recovered in 4,272 decapsulation queries.
Maintenance status
The crate is unmaintained (last release 0.7.1, August 2023); no patched version exists or is expected.
Mitigation
- If remaining on this crate, do not enable the
avx2feature; the default reference backend performs implicit rejection correctly. - Do not reuse a Kyber key pair across decapsulations.
Credit
Reported by 007bsd.
{
"affected": [
{
"database_specific": {
"categories": [
"crypto-failure"
],
"cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "pqc_kyber",
"purl": "pkg:cargo/pqc_kyber"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [],
"database_specific": {
"license": "CC0-1.0"
},
"details": "## Summary\n\nWhen `pqc_kyber` is built with the opt-in `avx2` feature on x86_64, its\nconstant-time conditional-move routine `cmov` is a no-op: it never performs the\ncopy. That `cmov` is exactly the step that applies the Fujisaki-Okamoto (FO)\nimplicit rejection during decapsulation. With it disabled, decapsulating an\n*invalid* ciphertext no longer returns a key-independent pseudorandom value;\nit returns a value that depends on the decrypted plaintext of the\nattacker-chosen ciphertext. This restores the chosen-ciphertext decryption\noracle that the FO transform exists to remove, and yields full recovery of the\nstatic secret key.\n\nThe attack requires no timing measurement, no side channel, and no faults; only\nthe ability to submit ciphertexts to a decapsulation operation under a reused\nkey pair and observe the resulting shared secret. See the linked pull request\nfor the root cause, the reachable call path, and reproduction details.\n\n## Affected configuration\n\nReachable only in builds with `features = [\"avx2\"]` on an x86_64 target. The\ndefault (reference) backend and all non-x86_64 targets are unaffected.\n\n## Impact\n\nComplete IND-CCA break. The plaintext-checking oracle drives a standard\nchosen-ciphertext key-recovery attack and extracts the entire static secret\nkey. Any protocol reusing a Kyber key pair across decapsulations (static or\nlong-term KEM keys, KEMTLS, HPKE recipients, pinned keys) is exposed;\nephemeral-only key shares are not. The defect was verified end to end on\nML-KEM-768: the full secret key was recovered in 4,272 decapsulation queries.\n\n## Maintenance status\n\nThe crate is unmaintained (last release 0.7.1, August 2023); no patched version\nexists or is expected.\n\n## Mitigation\n\n- If remaining on this crate, do not enable the `avx2` feature; the default\n reference backend performs implicit rejection correctly.\n- Do not reuse a Kyber key pair across decapsulations.\n\n## Credit\n\nReported by 007bsd.",
"id": "RUSTSEC-2026-0290",
"modified": "2026-09-18T09:06:23Z",
"published": "2026-08-16T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/pqc_kyber"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0290.html"
},
{
"type": "WEB",
"url": "https://github.com/Argyle-Software/kyber/pull/121"
}
],
"related": [],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "pqc_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.