Bouncy Castle Has Covert Timing Channel Vulnerability
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue only affects users of the FrodoKEM algorithm involved in the decryption of encapsulations. This issue affects BC-JAVA: from 1.71 to 1.80.1, 1.81, 1.82 to 1.83. Fixed versions: 1.80.2, 1.81.1, 1.84
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-5598US | — | — | ||
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).
This vulnerability is associated with program files FrodoEngine.Java.… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/bcgit/bc-javaPACKAGE
- https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5WEB
- https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87WEB
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598WEB
- https://github.com/bcgit/bc-java/wiki/CVE-2026-5598WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-5598ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan