CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/bcgit/bc-java/commit/1590247178f2280defa36421475f015175dfbe9e	Patch
https://github.com/bcgit/bc-java/commit/5adb2c5c5b462a332b01a012bea0784b40b904e5	Patch
https://github.com/bcgit/bc-java/wiki/CVE-2024-14041	Vendor Advisory
https://kyberslash.cr.yp.to/	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*

History

02 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) En Bouncy Castle para Java desde 1.73 hasta antes de 1.78, tres rutinas ML-KEM (CRYSTALS-Kyber) dividían los coeficientes polinómicos derivados del secreto por el módulo q: Poly.toMsg, que decodifica el mensaje descifrado, y las rutinas de compresión de texto cifrado Poly.compressPoly y PolyVec.compressPolyVec. Un atacante capaz de medir el tiempo de un gran número de desencapsulaciones realizadas con la misma clave privada a largo plazo puede recuperar esa clave. Estas son las divisiones KyberSlash1 (Poly.toMsg) y KyberSlash2 (compresión de texto cifrado). La compresión realizada durante la encapsulación opera sobre valores que se convierten en el texto cifrado público y no se ve afectada.

Information

Published : 2026-07-28 08:17

Updated : 2026-10-02 00:10

NVD link : CVE-2024-14041

Mitre link : CVE-2024-14041

CVE.ORG link : CVE-2024-14041

JSON object : View

Products Affected

bouncycastle

bc-java

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2024-14041", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-14041", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T12:54:52.417865Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "91579145-5d7b-4cc5-b925-a0262ff19630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "91579145-5d7b-4cc5-b925-a0262ff19630", "affectedData": [{"repo": "https://github.com/bcgit/bc-java", "vendor": "Legion of the Bouncy Castle Inc.", "modules": ["core"], "product": "BC-JAVA", "versions": [{"status": "affected", "version": "1.73", "lessThan": "1.78", "versionType": "maven"}], "platforms": ["all"], "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on", "packageName": "bcprov", "programFiles": ["Poly", "PolyVec"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/", "defaultStatus": "unaffected"}]}], "published": "2026-07-28T08:17:12.367", "references": [{"url": "https://github.com/bcgit/bc-java/commit/1590247178f2280defa36421475f015175dfbe9e", "tags": ["Patch"], "source": "91579145-5d7b-4cc5-b925-a0262ff19630"}, {"url": "https://github.com/bcgit/bc-java/commit/5adb2c5c5b462a332b01a012bea0784b40b904e5", "tags": ["Patch"], "source": "91579145-5d7b-4cc5-b925-a0262ff19630"}, {"url": "https://github.com/bcgit/bc-java/wiki/CVE-2024-14041", "tags": ["Vendor Advisory"], "source": "91579145-5d7b-4cc5-b925-a0262ff19630"}, {"url": "https://kyberslash.cr.yp.to/", "tags": ["Exploit"], "source": "91579145-5d7b-4cc5-b925-a0262ff19630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "91579145-5d7b-4cc5-b925-a0262ff19630", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected."}, {"lang": "es", "value": "En Bouncy Castle para Java desde 1.73 hasta antes de 1.78, tres rutinas ML-KEM (CRYSTALS-Kyber) divid\u00edan los coeficientes polin\u00f3micos derivados del secreto por el m\u00f3dulo q: Poly.toMsg, que decodifica el mensaje descifrado, y las rutinas de compresi\u00f3n de texto cifrado Poly.compressPoly y PolyVec.compressPolyVec. Un atacante capaz de medir el tiempo de un gran n\u00famero de desencapsulaciones realizadas con la misma clave privada a largo plazo puede recuperar esa clave. Estas son las divisiones KyberSlash1 (Poly.toMsg) y KyberSlash2 (compresi\u00f3n de texto cifrado). La compresi\u00f3n realizada durante la encapsulaci\u00f3n opera sobre valores que se convierten en el texto cifrado p\u00fablico y no se ve afectada."}], "lastModified": "2026-10-02T00:10:00.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D110EF44-AA25-4390-A427-107F5101325B", "versionEndExcluding": "1.78", "versionStartIncluding": "1.73"}], "operator": "OR"}]}], "sourceIdentifier": "91579145-5d7b-4cc5-b925-a0262ff19630"}