RUSTSEC-2026-0289 pqc_kyber is unmaintained
The unmaintained pqc_kyber library contains an unpatched key-recovery flaw, requiring users to migrate to maintained alternatives.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- None listed
What is RUSTSEC-2026-0289?
RUSTSEC-2026-0289 is a vulnerability in pqc_kyber, published on 17 Sep 2026.
Official description
The crate has had no releases since 0.7.1 (2023-08-23), and the upstream repository shows no maintainer activity. Open pull requests, including a fix for a chosen-ciphertext key-recovery flaw in the AVX2 backend (Argyle-Software/kyber#121), have gone unanswered.
Recommended alternatives:
Which versions are affected by RUSTSEC-2026-0289?
1 open source package ship an affected version, including pqc_kyber.
| Package | Affected | Fixed in |
|---|---|---|
pqc_kyber crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0289?
No fix has been published for RUSTSEC-2026-0289 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2026-0289 being exploited?
There is no known exploitation of RUSTSEC-2026-0289 in the wild and no public exploit code.