GHSA-9763-4f94-gfch
CIRCL's Kyber: timing side-channel (kyberslash2)
Impact
On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key.
Does not apply to ephemeral usage, such as when used in the regular way in TLS.
Patches
Patched in 1.3.7.
References
What each source reports
GitHub AdvisoriesNo score
CIRCL's Kyber: timing side-channel (kyberslash2)
Impact
On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key.
Does not apply to ephemeral usage, such as when used in the regular way in TLS.
Patches
Patched in 1.3.7.
References
- Record
GHSA-9763-4f94-gfch- Updated
- 2026-11-02
OSVNo score
CIRCL's Kyber: timing side-channel (kyberslash2)
Impact
On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key.
Does not apply to ephemeral usage, such as when used in the regular way in TLS.
Patches
Patched in 1.3.7.
References
- Record
GHSA-9763-4f94-gfch- Updated
- 2026-11-02
OSVGO-2024-2453No score
Timing side channel in github.com/cloudflare/circl
Timing side channel in github.com/cloudflare/circl
- Record
GO-2024-2453- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cloudflare/circlGo | before 1.3.7 | 1.3.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9763-4f94-gfch is a vulnerability with no CVSS score yet in github.com/cloudflare/circl, published January 8, 2024. No source lists public exploit code. Fixed in github.com/cloudflare/circl 1.3.7.