Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Legion of the Bouncy Castle BC-JAVA 1.86 Clear all filters
TI-2026-65797 CVE-2026-18036 · GHSA-frjj-v5w4-68pc

NTRU leaks private key information by reducing secret values with a non-constant-time integer division

Priority LOW 35

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer divis…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00282 Published 2026-10-02 Fixed in 1.86 CWE-208
TI-2026-65796 CVE-2026-17508 · GHSA-m3x3-p27c-whhp

Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

Priority LOW 24

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dic…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00418 Published 2026-10-02 Fixed in 1.86, 2.73.13 +3 CWE-770