CVE-2026-18040 | Legion of the Bouncy Castle Bouncy Castle Java up to 1.85 HQC timing discrepancy

October 3, 2026 Yanac

A vulnerability was found in Legion of the Bouncy Castle Bouncy Castle Java up to 1.85. It has been declared as problematic. The affected element is an unknown function of the component HQC. Such manipulation leads to observable timing discrepancy.

This vulnerability is uniquely identified as CVE-2026-18040. The attack can be launched remotely. No exploit exists.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More