CVE-2024-14041
Received Received - Intake

Timing Side-Channel in Bouncy Castle Java Kyber

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: bcorg

Description
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2024-14041
EUVD
EUVD-2024-55702

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bcgit bc-java From 1.73 (inc) to 1.78 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability, tracked as CVE-2024-14041, affects the Bouncy Castle Java library versions 1.73 to before 1.78. It involves three ML-KEM (CRYSTALS-Kyber) routines that perform secret-derived polynomial divisions by modulus q. These divisions, found in Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec, can leak timing information during decapsulation operations. An attacker measuring timing variations across many decapsulations with the same private key can recover that key. This is known as a side-channel timing attack.

Detection Guidance

This vulnerability involves timing side-channel attacks in Kyber cryptographic operations. Detection requires analyzing timing variations during decapsulation or compression routines in Bouncy Castle Java library versions 1.73 to 1.77. Use profiling tools to measure execution time of Poly.toMsg, Poly.compressPoly, or PolyVec.compressPolyVec functions. Compare timing patterns across multiple operations to identify inconsistencies that may indicate leakage.

Impact Analysis

If you use Bouncy Castle Java library versions 1.73 to 1.77 for Kyber cryptographic operations, an attacker could exploit this to recover your long-term private keys. This would allow decryption of past and future communications secured with those keys. The impact includes compromised confidentiality of encrypted data, potential unauthorized access to systems, and loss of trust in cryptographic operations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health information privacy) by compromising the confidentiality of personal or health data. Organizations using affected Bouncy Castle versions may fail to meet security requirements for protecting sensitive data, potentially resulting in legal penalties, loss of certification, or reputational damage.

Mitigation Strategies

Upgrade Bouncy Castle Java library to version 1.78 or later which contains patches for KyberSlash1 and KyberSlash2 vulnerabilities. Replace any custom Kyber implementations with the fixed versions from the library. Review cryptographic operations using Kyber to ensure they use constant-time implementations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-14041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart