CVE-2026-5598CWE-385

CVE-2026-5598

High · published April 15, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
61.2
In the wild
Unconfirmed
What it is

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).

This vulnerability is associated with program files FrodoEngine.Java.

This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00960 · 61.2th percentile
Weakness
CWE-385 · Covert Timing Channel
Published
2026-04-15T14:16Z
References (14)
https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5 · 91579145-5d7b-4cc5-b925-a0262ff19630https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87 · 91579145-5d7b-4cc5-b925-a0262ff19630https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598 · 91579145-5d7b-4cc5-b925-a0262ff19630https://access.redhat.com/errata/RHSA-2026:12267 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:12269 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:18054 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:18055 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:18059 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:53644 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:53645 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:53646 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-5598 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2458635 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 15 APR 09:05Z
    Non-constant time comparisons risk private key leakage in FrodoKEM.
    cvelistv5