CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-18036

Bouncy Castle for Java versions prior to 1.86 are vulnerable to a timing side-channel attack in the NTRU implementation. The root cause is the use of the % operator in three helpers, leading to integer division where latency depends on the secret operand. Specifically, Polynomial.modQ divides by ...

CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-18036

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

EUVD-2026-91317

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-17508 Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-17508

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-17508 Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

EUVD-2026-91236

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-17508

The Bouncy Castle for Java cryptographic library (versions before 1.86 , LTS before 2.73.13 , and FIPS before bcpkix-fips 1.0.13, 2.0.13, and 2.1.13) contains a vulnerability where password-based key derivation functions (KDFs) use unbounded cost parameters from untrusted input. Specifically, the...

CVE-2026-17508 Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-17507 MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...

CVE-2026-17507

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...

CVE-2026-17507 MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...

CVE-2026-17507

The Bouncy Castle for Java library (before version 1.86 ) contains a vulnerability in the MLS implementation (org.bouncycastle.mls). The root cause is a signed to unsigned conversion error where an RFC 9420 uint32 leaf_index is stored as a signed integer. Because values with the top bit set decod...

EUVD-2026-91235

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...

CVE-2026-17507: Signed to Unsigned Conversion Error

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...

PT-2026-104127

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leaf index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the...

PT-2026-104128

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...