CVE-2026-18036

🗓️ 02 Oct 2026 07:54:16Reported by MendType

mend🔗 www.mend.io👁 51 Views

Timing side-channel in Bouncy Castle for Java NTRU reduced secret values via division.

Reporter	Title	Published	Views	Family All 57
IBM Security Bulletins	Security Bulletin:Multiple vulnerabilities in bcpkix-jdk18on may affect IBM Infosphere Change Data Capture (CVE-2026-17508, CVE-2026-18036)	26 Oct 202607:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM License Metric Tool v9	30 Oct 202610:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Bouncy Castle	29 Oct 202608:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool v9 Software as a Service	30 Oct 202609:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Configuration Manager is affected by multiple Bouncy Castle and Apache MINA SSHD vulnerabilities that may cause denial of service, resource exhaustion, cryptographic verification bypass, or authentication issues.	31 Oct 202617:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational Developer for i is affected by Multiple vulnerabilities	28 Oct 202615:51	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition	15 Oct 202607:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF004 and 26.0.1-IF001 for October 2026	30 Oct 202603:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	14 Oct 202612:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM BigMemory Max is affected by bcprov-jdk18on that could allow attackers to execute a denial of service by exhausting system resources	28 Oct 202618:03	–	ibm

Vulners

Node

bouncycastle bcprov-jdk15to18Range1.72–1.85.2

bouncycastle bcprov-jdk14Range1.72–1.85.2

bouncycastle bcprovRange1.72–1.86

bouncycastle bcprov-jdk18onRange1.72–1.85.2

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18036.json
bouncycastle	www.bouncycastle.org/download/bouncy-castle-java/
github	www.github.com/bcgit/bc-java
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-18036
github	www.github.com/bcgit/bc-java/blob/r1rv86/docs/releasenotes.md
github	www.github.com/bcgit/bc-java/commit/9c9ad88b6003bb6230d2434bd892cc1e95b294e4
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9018036
github	www.github.com/bcgit/bc-java/commit/2283ca771abb77ab142947e402714f671ba5ea2b

08 Oct 2026 00:07Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.9

CVSS 48.2

EPSS0.00282

SSVC

CWE-208