BC-JAVA: Timing side channel in NTRU leaks private key information
Summary
Bouncy Castle for Java before 1.86 uses integer division with secret operands in its NTRU implementation. The execution time of these operations depends on the secret data, so an attacker who can precisely measure timing may recover information about the NTRU private key. The issue affects applications that perform NTRU key operations, including KEM operations reachable through the standard javax.crypto.KEM API.
Affected
- BC-JAVA (bcprov) from 1.73 to before 1.86
- Java 8 and later
- Default provider: unaffected unless NTRU is used
Fixed in
- BC-JAVA 1.86 (vendor release of 2026-09-15)
- Fix commit: 9c9ad88b6003bb6230d2434bd892cc1e95b294e4
- Distribution packages: check the distributor's advisory (e.g. OpenSUSE Tumbleweed bouncycastle 1.86-1.1)
Workaround
- Unknown. The vendor does not describe a workaround.
- If the application does not use NTRU, avoid calling NTRU operations so the affected code path is not reached.
Exploitation
- No evidence of exploitation found.
- No public exploit or proof of concept found.
- Not listed in CISA KEV.
- Exploitation requires precise timing measurements.
Our recommendation
- Inventory Java applications and dependency trees for bcprov, bcpkix and bcpg.
- Upgrade bcprov to 1.86 or later in the next regular patch cycle; expedite if NTRU KEM is used on internet-facing services.
- Check whether NTRU is used directly or indirectly via javax.crypto.KEM.
- Verify the fixed version with your distributor's advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Bouncy Castle wiki: CVE-2026-18036 github.com
- Fix commit 9c9ad88b6003 github.com
- Bouncy Castle 1.86 release announcement www.bouncycastle.org
- OSV: Debian CVE-2026-18036 osv.dev
- SUSE CVE record CVE-2026-18036 vulners.com
- OpenCVE: CVE-2026-18036 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:31.
Original description (NVD)
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a variable divisor, which a compiler cannot strength-reduce to a multiply the way it can a constant one, so it emitted a division on every call including on the decapsulation path where the dividend derives from the private key; Polynomial.mod3 and NTRUSampling.mod3 divided the secret key polynomials f and g during key generation, the message polynomials r and m during encapsulation, and coefficients recovered during decapsulation. An attacker able to measure that timing can recover information about the NTRU private key. modQ now masks, which is exact because q is always a power of two, and mod3 uses the reference implementation's division-free fold and select; the results are unchanged.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.