CVE-2026-6330: ML-KEM ARM64 NEON ciphertext comparison only compares half of the input
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating party could fail to detect a manipulated ciphertext and proceed without the standard's required implicit rejection.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6330?
CVE-2026-6330 has a medium severity rating of 6.3 according to the CVSS score.
How do I fix CVE-2026-6330?
To fix CVE-2026-6330, apply the available patch from wolfSSL as soon as possible.
What is the impact of CVE-2026-6330?
CVE-2026-6330 weakens IND-CCA2 security by not fully comparing the ciphertext, potentially leading to vulnerabilities in encrypted communications.
Is there a workaround for CVE-2026-6330?
No specific workaround is recommended for CVE-2026-6330; patching the software is the best mitigation.
Which software does CVE-2026-6330 affect?
CVE-2026-6330 affects the ML-KEM implementation in wolfSSL that uses ARM64 NEON ciphertext comparison.