← Back to the live CVE advisory feed

CVE-2026-18036: Product identification pending

Severity

8.2 (HIGH)

Vendor

BOUNCY CASTLE FOR JAVA

Affected versions

Before 1.86

Fixed version

1.86

Patch status

Patched

Published

2026-10-02T08:17:01.660

Modified

2026-10-02T08:17:01.660

Why it matters

High-severity vulnerability requiring prioritized review.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.

Technical summary

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a variable divisor, which a compiler cannot strength-reduce to a multiply the way it can a constant one, so it emitted a division on every call including on the decapsulation path where the dividend derives from the private key; Polynomial.mod3 and NTRUSampling.mod3 divided the secret key polynomials f and g during key generation, the message polynomials r and m during encapsulation, and coefficients recovered during decapsulation. An attacker able to measure that timing can recover information about the NTRU private key. modQ now masks, which is exact because q is always a power of two, and mod3 uses the reference implementation's division-free fold and select; the results are unchanged.

View the official NVD record for CVE-2026-18036

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.