CVE-2024-14041: bouncycastle bc-java Observable Timing Discrepancy

Vulnerability summary

CVE-2024-14041 is a high (CVSS 8.2) Observable Timing Discrepancy vulnerability in bouncycastle bc-java. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-07-2026
   PublishedVulnerability first disclosed.
2. 09-08-2026
   Last modifiedVulnerability information updated.

Description

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected.

• CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.