Medium · CVSS 5.9CVE-2026-18040

HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler

Answer in brief

CVE-2026-18040 records a Medium severity (CVSS 5.9) vulnerability in HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler. The current sources do not mark it as known exploited. The current feed maps Legion of the Bouncy Castle Inc./bcprov (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 3, 2026Updated Oct 3, 2026Source checked Oct 3, 2026First seen by HOL Oct 3, 2026Material review Oct 3, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 5.9
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Legion of the Bouncy Castle Inc./bcprov (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Legion of the Bouncy Castle Inc./bcprovgeneric	>=1.73 <1.86	1.86

Recommended response

Check inventory. Check lockfiles and deployed manifests for Legion of the Bouncy Castle Inc./bcprov.
Review the reported fix. Update Legion of the Bouncy Castle Inc./bcprov to 1.86 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Oct 3, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 3, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 3, 2026

Sources and claim methodology

Upstream source description

In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithmetic is now table-free and the sampler branch-free within a batch of candidates, with output and randomness consumption unchanged.

Quoted source text, attributed separately from HOL analysis.