Skip to content
OpenAdvisories
Medium WID-SEC-2026-2550 1 CVE

Bouncy Castle: Schwachstelle ermöglicht Offenlegung von Informationen

Published Jul 27, 2026 · Updated Jul 27, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Bouncy Castle ausnutzen, um Informationen offenzulegen.

Product

Bouncy Castle ist eine Kryptographie-API für Java.

Vulnerabilities 1

  • High 8.2
    CVE-2024-14041

    ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)

    In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressP…

    Legion of the Bouncy Castle BC-JAVA bouncycastle bouncycastle Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References