CVE-2026-59650: MTI/A0 DH agreement exponentiates unvalidated peer value

Affects Bouncy Castle for Java LTS before 2.73.12. DHAgreement, implementing the MTI/A0 two-pass variant, raises the peer-supplied message value to the local static private key without any range or subgroup-membership check, unlike the validated public-key argument. A malicious peer that repeatedly sends small-order elements learns the private key modulo a small prime from each exchange and recovers it in full by combining them. DHBasicAgreement is unaffected because its only input is validated.