CVE-2024-14041

A flaw was found in Bouncy Castle for Java, affecting ML-KEM (CRYSTALS-Kyber) routines. Specifically, the Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines, which handle secret-derived polynomial coefficients, perform division by the modulus q. A remote attacker can exploit this timing side-channel vulnerability by measuring the time taken for a large number of decapsulations using the same long-term private key. Successful exploitation allows the attacker to recover the long-term private key, leading to a significant compromise of cryptographic security.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.