Information Exposure Through Timing Discrepancy in Bouncy Castle for Java - CVE-2026-18036
Published: October 21, 2026
Vulnerability identifier: #VU156706
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18036
CWE-ID: CWE-208
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to recover information about NTRU private key material through timing measurements.
The vulnerability exists due to observable timing discrepancies in the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling when performing secret-dependent modular reductions during key generation, encapsulation, and decapsulation. A remote attacker can measure and analyze the latency of these operations to infer information about NTRU private key material.
Affected software
Bouncy Castle for Java
How to mitigate CVE-2026-18036
Install security update from vendor's website.
Bouncy Castle for Java - update to 1.86