CVE-2026-5598

HighCVSS 7.5

Published: 15/04/2026(UTC)Updated: 10/09/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.90%

58th percentile - higher than 58% of all known CVEs

Summary

A covert timing channel vulnerability in the BC-JAVA core library allows an attacker to extract information by measuring the time of cryptographic operations. The issue affects core modules, specifically the FrodoEngine.Java file.

Risk Assessment

An attacker can exploit timing differences to recover keys or other secret data, leading to a breach of confidentiality in systems using this library.

Recommendation

Immediately update BC-JAVA to version 1.80.2, 1.81.1, or 1.84 depending on the branch used. If an update is not possible, consider applying temporary mitigations that mask operation times.

Other vulnerabilities in BC-JAVA

CVE-2026-3505High
A vulnerability in the BC-JAVA library (pgp modules) causes uncontrolled resource consumption due to missing limits in AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, and OperatorHelper.Java. An attacker can exhaust system resources.

Original NVD description (English source)

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.