PT-2026-104566 · Unknown · Bouncy Castle For Java
CVE-2026-18040
·
Published
2026-10-03
·
Updated
2026-10-03
CVSS v4.0
5.9
Medium
| Vector | AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber |
Name of the Vulnerable Software and Affected Versions
Bouncy Castle for Java versions prior to 1.86
Description
HQC leaks secret-derived data through two side channels during encapsulation and decapsulation. The GF(2^8) arithmetic uses lookup tables indexed by field elements, causing the touched cache line to be a function of the operand. Additionally, the fixed-weight support sampler terminates its duplicate scan upon finding a collision and stores accepted positions at a secret index. Because the sampler re-expands the secret key from its seed during every decapsulation, an attacker observing cache behavior or decapsulation timing can recover information about the HQC private key.
Recommendations
Update to version 1.86 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bouncy Castle For Java