CVE-2026-18040
published 2026-10-03CVE-2026-18040: In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field…
PriorityP423medium5.9CVSS 4.0
AVLACHATPPRNUINVCHVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUAmber
EPSS
0.11%
1.1th percentile
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithmetic is now table-free and the sampler branch-free within a batch of candidates, with output and randomness consumption unchanged.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| candlepinproject | candlepin | — | — |
| devspaces | jetbrains-ide-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| jboss-eap-7 | eap74-els-openjdk11-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk17-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk8-openshift-rhel8 | — | — |
| jenkins | jenkins | — | — |
| legion_of_the_bouncy_castle_inc | bc-java | >= 1.73 < 1.86 | 1.86 |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| rhbk | keycloak-rhel9 | — | — |
| rhoai | odh-modelmesh-rhel9 | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
CVSS provenance
nvdv4.05.9MEDIUMCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
bouncycastle: bcprov-jdk18on: bouncycastle: Information disclosure via cryptographic side channels in HQC
vendor_redhat·2026-10-03·CVSS 5.9
CVE-2026-18040 [MEDIUM] CWE-208 bouncycastle: bcprov-jdk18on: bouncycastle: Information disclosure via cryptographic side channels in HQC
bouncycastle: bcprov-jdk18on: bouncycastle: Information disclosure via cryptographic side channels in HQC
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithmetic is now table-free and the sampler bran
GHSA
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a fu
ghsa_unreviewed·2026-10-03
CVE-2026-18040 [MEDIUM] CWE-208 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a fu
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithmetic is now table-free and the sampler branch-free within a batch of candidates, with output and randomness consumption unchanged.
VulDB
Legion of the Bouncy Castle Bouncy Castle Java up to 1.85 HQC timing discrepancy
vuldb·2026-10-03·CVSS 5.9
CVE-2026-18040 [MEDIUM] Legion of the Bouncy Castle Bouncy Castle Java up to 1.85 HQC timing discrepancy
A vulnerability was found in Legion of the Bouncy Castle Bouncy Castle Java up to 1.85. It has been declared as problematic. The affected element is an unknown function of the component HQC. Such manipulation leads to observable timing discrepancy.
This vulnerability is uniquely identified as CVE-2026-18040. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-18040 bouncycastle: bouncycastle: Information disclosure via cryptographic side channels in HQC [fedora-all]
bugzilla·2026-10-15·CVSS 5.9
CVE-2026-18040 [MEDIUM] CVE-2026-18040 bouncycastle: bouncycastle: Information disclosure via cryptographic side channels in HQC [fedora-all]
CVE-2026-18040 bouncycastle: bouncycastle: Information disclosure via cryptographic side channels in HQC [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expan
Bugzilla
CVE-2026-18040 apache-sshd: bouncycastle: Information disclosure via cryptographic side channels in HQC [fedora-all]
bugzilla·2026-10-15·CVSS 5.9
CVE-2026-18040 [MEDIUM] CVE-2026-18040 apache-sshd: bouncycastle: Information disclosure via cryptographic side channels in HQC [fedora-all]
CVE-2026-18040 apache-sshd: bouncycastle: Information disclosure via cryptographic side channels in HQC [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expand
Bugzilla
CVE-2026-18040 voms-api-java: bouncycastle: Information disclosure via cryptographic side channels in HQC [fedora-all]
bugzilla·2026-10-15·CVSS 5.9
CVE-2026-18040 [MEDIUM] CVE-2026-18040 voms-api-java: bouncycastle: Information disclosure via cryptographic side channels in HQC [fedora-all]
CVE-2026-18040 voms-api-java: bouncycastle: Information disclosure via cryptographic side channels in HQC [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expa
Bugzilla
CVE-2026-18040 voms-api-java: bouncycastle: Information disclosure via cryptographic side channels in HQC [epel-all]
bugzilla·2026-10-15·CVSS 5.9
CVE-2026-18040 [MEDIUM] CVE-2026-18040 voms-api-java: bouncycastle: Information disclosure via cryptographic side channels in HQC [epel-all]
CVE-2026-18040 voms-api-java: bouncycastle: Information disclosure via cryptographic side channels in HQC [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expand
Bugzilla
CVE-2026-18040 bouncycastle: bcprov-jdk18on: bouncycastle: Information disclosure via cryptographic side channels in HQC
bugzilla·2026-10-03·CVSS 5.9
CVE-2026-18040 [MEDIUM] CVE-2026-18040 bouncycastle: bcprov-jdk18on: bouncycastle: Information disclosure via cryptographic side channels in HQC
CVE-2026-18040 bouncycastle: bcprov-jdk18on: bouncycastle: Information disclosure via cryptographic side channels in HQC
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithmetic is now table-free and t
2026-10-03
Published