In Bouncy Castle for Java prior to version 1.86, the HQC cryptographic scheme leaked secret-derived data via two side channels. First, the GF(2^8) arithmetic used lookup tables indexed by secret field elements, causing cache line accesses to depend on secret data. Second, the fixed-weight support sampler leaked information by exiting duplicate scans early upon collision and storing accepted positions at secret indices, with these operations running on secret inputs during encapsulation and decapsulation. The sampler also re-expands the secret key from its seed on every decapsulation, increasing exposure. These side channels allow attackers who can observe cache behavior or decapsulation timing to gain information about the HQC private key. The issue was fixed by eliminating table lookups in field arithmetic and making the sampler branch-free within candidate batches, without changing output or randomness consumption.

The side-channel vulnerabilities allow attackers with the capability to monitor cache behavior or timing during cryptographic operations to recover partial information about the HQC private key. This leakage compromises the confidentiality of the private key used in encapsulation and decapsulation, potentially undermining the security of cryptographic operations relying on HQC in affected Bouncy Castle versions.

A fixed version of Bouncy Castle for Java (version 1.86 or later) addresses these side-channel leaks by removing lookup tables from GF(2^8) arithmetic and making the fixed-weight support sampler branch-free. Users should upgrade to version 1.86 or later to mitigate these vulnerabilities. No other mitigation actions are indicated.