—

RUSTSEC-2026-0287

cosmian_kyber is unmaintained

Details

`cosmian_kyber` is a fork of `Argyle-Software/kyber` that has seen no maintainer activity. It inherits the fork parent's broken AVX2 constant-time code, and the open fix pull request (Cosmian/kyber#6) has gone unanswered.

Recommended alternatives:

- [aws-lc-rs](https://crates.io/crates/aws-lc-rs) - [graviola](https://crates.io/crates/graviola)

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/cosmian_kyber

Introduced in: 0.0.0-0

No fixed version published yet for cosmian_kyber. Pin to a known-safe version or switch to an alternative.

References

https://crates.io/crates/cosmian_kyber[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2026-0287.html[ADVISORY]
https://github.com/Cosmian/kyber/pull/6[WEB]