Quick answers
- Is CVE-2026-18036 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18036 being exploited in the wild.
- How severe is CVE-2026-18036?
- Informational severity, published 2 October 2026.
- Which products and versions are affected?
- Bouncy Castle for Java before 1.86.
- Is there a fix for CVE-2026-18036?
- Yes: fixed in 1.86. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18036 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-18036?
- Check whether you run Bouncy Castle for Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.86
Technical details
NTRU's mod3 and modQ reduction helpers used the % operator on secret values, whose integer division latency depends on the secret operand, instead of implementing the reference's division-free algorithms. The modQ reduction in Polynomial was exposed on the decapsulation path where the dividend derives from the private key; mod3 reductions in Polynomial and NTRUSampling were exposed during key generation, encapsulation, and decapsulation. Bouncy Castle 1.86 replaces these with masking for modQ and division-free fold-and-select for mod3.
Affected products
- Bouncy Castle Bouncy Castle for Java before 1.86
Timeline
- 2026-07-28: patched
- 2026-10-02: disclosed