rustsec-2026-0287
osv_rustsec
Description
`cosmian_kyber` is a fork of `Argyle-Software/kyber` that has seen no maintainer activity. It inherits the fork parent's broken AVX2 constant-time code, and the open fix pull request (Cosmian/kyber#6) has gone unanswered. Recommended alternatives: - [aws-lc-rs](https://crates.io/crates/aws-lc-rs) - [graviola](https://crates.io/crates/graviola)
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"categories": [],
"cvss": null,
"informational": "unmaintained",
"source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0287.json"
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "cosmian_kyber",
"purl": "pkg:cargo/cosmian_kyber"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
}
],
"type": "SEMVER"
}
]
}
],
"database_specific": {
"license": "CC0-1.0"
},
"details": "`cosmian_kyber` is a fork of `Argyle-Software/kyber` that has seen no maintainer\nactivity. It inherits the fork parent's broken AVX2 constant-time code, and the\nopen fix pull request (Cosmian/kyber#6) has gone unanswered.\n\nRecommended alternatives:\n\n- [aws-lc-rs](https://crates.io/crates/aws-lc-rs)\n- [graviola](https://crates.io/crates/graviola)",
"id": "RUSTSEC-2026-0287",
"modified": "2026-09-18T09:15:05.147975858Z",
"published": "2026-09-17T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/cosmian_kyber"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0287.html"
},
{
"type": "WEB",
"url": "https://github.com/Cosmian/kyber/pull/6"
}
],
"schema_version": "1.9.0",
"summary": "cosmian_kyber is unmaintained"
}