CVE-2026-18036

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86

Description NTRU secret values are reduced using the % operator in three helper functions, which deviates from the division-free reference implementations. This results in integer divisions where latency depends on the secret operand. Specifically, the Polynomial.modQ function uses a variable divisor that prevents compiler strength-reduction, leading to division on every call, including the decapsulation path where the dividend is derived from the private key. Additionally, Polynomial.mod3 and NTRUSampling.mod3 perform divisions on secret key polynomials f and g during key generation, message polynomials r and m during encapsulation, and coefficients during decapsulation. An attacker capable of measuring these timing differences can recover information about the NTRU private key.

Recommendations Update to version 1.86 or later.