{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"bouncycastle","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQW2DPJ5EQ1S4KZX67NRT2","modified_at":"2026-10-03T05:00:08.209454437Z","published_at":"2026-10-02T08:17:01.660Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-18036","https://security-tracker.debian.org/tracker/CVE-2026-18036"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-18036","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-18036"}],"summary":"In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out"}