RUSTSEC-2026-0289
pqc_kyber is unmaintained
The crate has had no releases since 0.7.1 (2023-08-23), and the upstream repository shows no maintainer activity. Open pull requests, including a fix for a chosen-ciphertext key-recovery flaw in the AVX2 backend (Argyle-Software/kyber#121), have gone unanswered.
Recommended alternatives:
What each source reports
OSVNo score
pqc_kyber is unmaintained
The crate has had no releases since 0.7.1 (2023-08-23), and the upstream repository shows no maintainer activity. Open pull requests, including a fix for a chosen-ciphertext key-recovery flaw in the AVX2 backend (Argyle-Software/kyber#121), have gone unanswered.
Recommended alternatives:
- Record
RUSTSEC-2026-0289- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pqc_kybercrates.io | 0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0289 is a vulnerability with no CVSS score yet in pqc_kyber, published September 17, 2026. No source lists public exploit code. No source names a fixed version.