—

RUSTSEC-2026-0289

pqc_kyber is unmaintained

Details

The crate has had no releases since 0.7.1 (2023-08-23), and the upstream repository shows no maintainer activity. Open pull requests, including a fix for a chosen-ciphertext key-recovery flaw in the AVX2 backend (Argyle-Software/kyber#121), have gone unanswered.

Recommended alternatives:

- [aws-lc-rs](https://crates.io/crates/aws-lc-rs) - [graviola](https://crates.io/crates/graviola)

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/pqc_kyber

Introduced in: 0.0.0-0

No fixed version published yet for pqc_kyber. Pin to a known-safe version or switch to an alternative.

References

https://crates.io/crates/pqc_kyber[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2026-0289.html[ADVISORY]
https://github.com/Argyle-Software/kyber/pull/121[WEB]