CVE-2026-59650: MTI/A0 DH agreement exponentiates unvalidated peer value

Affects Bouncy Castle for Java before 1.85. DHAgreement, implementing the MTI/A0 two-pass variant, raises the peer-supplied message value to the local static private key without any range or subgroup-membership check, unlike the validated public-key argument. A malicious peer that repeatedly sends small-order elements learns the private key modulo a small prime from each exchange and recovers it in full by combining them. DHBasicAgreement is unaffected because its only input is validated.