# CVE-2026-18040: Bouncy Castle HQC side-channel information leak

Source: https://junglewise.ai/threats/cve-2026-18040-in-bouncy-castle-for-java-before-1-86-hqc-leaked-secret-derived  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-18040 · Severity: info · Published 2026-10-03

Bouncy Castle for Java is a widely used cryptographic library that implements the HQC post-quantum encryption algorithm. The library leaked information about private encryption keys through two observable side channels: cache behavior during arithmetic operations and timing variations during decryption. An attacker observing these side channels during normal encryption or decryption operations could gradually recover the private key.

Technologies: [Bouncy Castle for Java](https://junglewise.ai/threats/technologies/bouncy-castle-for-java). Vendors: [Bouncy Castle](https://junglewise.ai/threats/vendors/bouncy-castle).

## Quick answers

**Is CVE-2026-18040 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18040 being exploited in the wild.

**How severe is CVE-2026-18040?** Informational severity, published 3 October 2026.

**Which products and versions are affected?** Bouncy Castle for Java before 1.86.

**Is there a fix for CVE-2026-18040?** Yes: fixed in 1.86 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18040 attacked?** It is attacked from the adjacent network or with local access.

**Am I affected by CVE-2026-18040?** Check whether you run Bouncy Castle for Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.86 and later

## Technical details

HQC's Galois Field arithmetic used lookup tables indexed by secret field elements, leaking information via cache line selection, and the fixed-weight sampler exhibited timing variation based on secret data due to early loop termination on collision detection. Both operations run on secret inputs during encapsulation and decapsulation, with the sampler re-expanding the secret key on every decapsulation, enabling cache or timing side-channel attacks to extract private key material. Fixes include table-free field arithmetic and branch-free sampler implementations with identical output.

## Affected products

- Bouncy Castle Bouncy Castle for Java before 1.86

## Timeline

- 2026-10-03: disclosed

## References

- [https://www.bouncycastle.org/download/bouncy-castle-java/](https://www.bouncycastle.org/download/bouncy-castle-java/)
- [https://github.com/bcgit/bc-java/commit/283acd81048ec9e951032525279d3b58aaf0bb03](https://github.com/bcgit/bc-java/commit/283acd81048ec9e951032525279d3b58aaf0bb03)

## Related threats

- [Bouncy Castle for Java truncated OpenPGP message acceptance](https://junglewise.ai/threats/cve-2026-85515-in-bouncy-castle-for-java-before-1-86-a-truncated-openpgp)
- [Bouncy Castle for Java BLS signature phantom signer](https://junglewise.ai/threats/cve-2026-71891-in-bouncy-castle-for-java-before-1-86-bls12-381basicscheme)
- [Bouncy Castle MLS external commit validation bypass](https://junglewise.ai/threats/cve-2026-71890-in-bouncy-castle-for-java-before-1-86-validation-of-an-mls-rfc)
- [Bouncy Castle for Java X.509 name constraints bypass in PKIXCertPathReviewer](https://junglewise.ai/threats/cve-2026-71889-in-bouncy-castle-for-java-before-1-86-neither-copy-of)
- [Bouncy Castle for Java OpenPGP signature misattribution in subkey binding validation](https://junglewise.ai/threats/cve-2026-71887-in-bouncy-castle-for-java-before-1-86-the-high-level-openpgp-api)