CVE-2026-18040
Received Received - Intake

HQC Private Key Leakage in Bouncy Castle Java

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: bcorg

Description
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithmetic is now table-free and the sampler branch-free within a batch of candidates, with output and randomness consumption unchanged.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-18040
EUVD
EUVD-2026-92004

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bouncy_castle bc_java 1.86
bouncy_castle bouncy_castle_java to 1.86 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18040 is a side-channel vulnerability in Bouncy Castle Java library versions before 1.86 affecting the HQC post-quantum cryptography implementation. It leaks private key information through cache timing and timing analysis during cryptographic operations.

Detection Guidance

Detecting this vulnerability requires checking if your Bouncy Castle Java library version is before 1.86. Use commands like 'mvn dependency:tree' or 'gradle dependencies' to inspect the library version in your project. If using a JAR file, check the manifest or run 'java -jar your-jar.jar' to see the version.

Impact Analysis

An attacker could exploit this vulnerability to recover private key information by observing cache behavior or decapsulation timing. This could lead to compromise of encrypted communications or data protected by HQC in applications using vulnerable Bouncy Castle versions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable versions may face compliance violations if personal or health data is exposed through key compromise.

Mitigation Strategies

Upgrade Bouncy Castle for Java to version 1.86 or later to address the side-channel vulnerabilities in the HQC implementation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18040. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart