EUVD-2026-91317
GHSA-frjj-v5w4-68pc
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Unauthenticated (PR:N) since timing is observed without credentials, but AC:H because key recovery needs many low-noise timing samples; confidentiality-only (key leak), no I/A impact.
Primary rating from Vendor (bcorg).
CVSS VectorVendor: bcorg
Lifecycle Timeline
2DescriptionCVE.org
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a variable divisor, which a compiler cannot strength-reduce to a multiply the way it can a constant one, so it emitted a division on every call including on the decapsulation path where the dividend derives from the private key; Polynomial.mod3 and NTRUSampling.mod3 divided the secret key polynomials f and g during key generation, the message polynomials r and m during encapsulation, and coefficients recovered during decapsulation. An attacker able to measure that timing can recover information about the NTRU private key. modQ now masks, which is exact because q is always a power of two, and mod3 uses the reference implementation's division-free fold and select; the results are unchanged.
Articles & Coverage 1
AnalysisAI
Timing side-channel leakage in Bouncy Castle for Java (bc-java) versions before 1.86 exposes private-key information from NTRU post-quantum KEM operations because three modular-reduction helpers used the '%' operator, which compiles to an integer division whose latency depends on the secret operand. Affected call paths include key generation (secret polynomials f and g), encapsulation (message polynomials r and m), and decapsulation (coefficients recovered from the private key), and the CVSS 4.0 base score is 8.2 (assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality only). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application actually uses Bouncy Castle's NTRU KEM operations (key generation, encapsulation, or decapsulation) from a version before 1.86 with a persistent/reused private key, AND that the attacker can repeatedly invoke those operations while measuring their execution time with enough precision to resolve secret-dependent integer-division latency. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a cryptographic timing side-channel (CWE-208) in the NTRU post-quantum KEM of Bouncy Castle for Java before 1.86, where three reduction helpers (Polynomial.modQ, Polynomial.mod3, NTRUSampling.mod3) used the '%' operator, compiling to integer divisions whose latency depends on secret operands (private-key polynomials f/g, message polynomials r/m, and coefficients recovered during decapsulation). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Bouncy Castle for Java to version 1.86 or later, which replaces the three timing-variable '%' reductions with the division-free masked/fold-and-select implementations (Polynomial.modQ now masks with q - 1, and Polynomial.mod3 plus NTRUSampling.mod3 use the reference fold-and-select); see the advisory https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9018036 and the fix commit https://github.com/bcgit/bc-java/commit/9c9ad88b6003bb6230d2434bd892cc1e95b294e4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Java applications and libraries using Bouncy Castle for Java (bc-java) earlier than 1.86, identify any that invoke NTRU KEM operations (key generation, encapsulation, or decapsulation), and prioritize patching internet-facing or co-located services by upgrading to bc-java 1.86 or later; Vendor-released patch: 1.86. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today