PQCrypto-LWEKE

FrodoKEM: Learning with Errors Key Encapsulation This C library implements FrodoKEM , an IND-CCA secure key encapsulation KEM protocol based on the well-studied Learning with Errors LWE problem 1,3, which in turn has close connections to conjectured-hard problems on generic, "algebraically...

PT-2026-95566

Summary cosmian kyber is a fork of Argyle-Software/kyber and inherits a broken constant-time conditional-move routine cmov in its AVX2 backend. When built with the opt-in avx2 feature on x86 64, cmov is a no-op: it never performs the copy. That cmov is the step that applies the Fujisaki-Okamoto F...

PT-2026-95567

Summary When pqc kyber is built with the opt-in avx2 feature on x86 64, its constant-time conditional-move routine cmov is a no-op: it never performs the copy. That cmov is exactly the step that applies the Fujisaki-Okamoto FO implicit rejection during decapsulation. With it disabled, decapsulati...

EUVD-2026-39570

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

CVE-2026-6330

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

CVE-2026-6330 ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

PT-2026-52560

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description The AVX2-optimized ML-KEM implementation contains a logic error in the mlkem cmp avx2 function during the Fujisaki-Okamoto transform. In ML-KEM-1024 decapsulation, the constant-time ciphertex...

PT-2026-52603

Name of the Vulnerable Software and Affected Versions ML-KEM affected versions not specified Description An issue exists in the ARM64 NEON ciphertext comparison where only half of the input is compared. This failure breaks the implicit rejection of the Fujisaki-Okamoto transform—a method used to...