In Bouncy Castle for Java versions >=1.73 and <1.86, the HQC cryptographic scheme leaks secret-derived data via two side channels: (1) GF(2^8) arithmetic uses lookup tables indexed by secret field elements, causing cache line access patterns dependent on secret data; (2) the fixed-weight support sampler exits its duplicate scan early upon collision and stores accepted positions at secret indices, causing timing discrepancies. Both operations run on secret inputs during encapsulation and decapsulation, with the sampler re-expanding the secret key from its seed on every decapsulation. An attacker able to observe cache behavior or decapsulation timing can thus recover information about the HQC private key. The fix replaces table-based arithmetic with table-free methods and makes the sampler branch-free within candidate batches, eliminating these side channels without changing output or randomness consumption.

The vulnerability allows attackers who can observe cache behavior or timing during cryptographic operations to recover partial information about the HQC private key. This leakage compromises the confidentiality of the private key, potentially weakening the security guarantees of the cryptographic scheme. However, exploitation requires local observation capabilities (local vector attack) and high attack complexity, reflected in the medium CVSS score of 5.9.

A fixed version of Bouncy Castle for Java is available starting from version 1.86, which removes the vulnerable table lookups and timing branches. Users should upgrade to version 1.86 or later to mitigate this vulnerability. No additional mitigation is required once upgraded. Since this is not a cloud service, remediation depends on user upgrade.