This vulnerability arises from observable timing discrepancies in three specific routines of the CRYSTALS-Kyber implementation in Bouncy Castle for Java versions 1.73 through before 1.78. The affected routines perform divisions of secret-derived polynomial coefficients by the modulus q, which leak timing information. An attacker capable of measuring the timing of a large number of decapsulations using the same private key can exploit these timing differences to recover the private key. The affected routines are Poly.toMsg (used for decoding decrypted messages) and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPoly. Compression during encapsulation is unaffected as it operates on public ciphertext values. No official fix or patch has been documented yet.

Successful exploitation allows an attacker to recover the long-term private key used in the affected Kyber cryptographic routines by analyzing timing discrepancies during decapsulation operations. This compromises the confidentiality of communications relying on the affected Bouncy Castle Java implementation of CRYSTALS-Kyber. The vulnerability does not affect the encapsulation compression process and requires the attacker to measure timing over many decapsulations with the same key.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure of the affected decapsulation operations to untrusted parties or applying additional mitigations to reduce timing side-channel leakage if possible. Monitor vendor communications for updates on patches or official mitigations.