CVE-2026-18040HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler
Updated under an hour ago ()
Does this affect you?
It affects Legion of the Bouncy Castle Inc. BC-JAVA. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithmetic is now table-free and the sampler branch-free within a batch of candidates, with output and randomness consumption unchanged.
- CVSS
- 5.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber
- Weakness (CWE)
- CWE-208
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- bcorg
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 5, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Legion of the Bouncy Castle Inc. BC-JAVA legion_of_the_bouncy_castle:bc_java (from the name) | from 1.73 before 1.86 | CNA record |
References
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9018040vendor-advisory
- https://github.com/bcgit/bc-java/commit/283acd81048ec9e951032525279d3b58aaf0bb03patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.