CVE-2026-5598
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).
highEPSS 49%
Severity
high
96.07
no public PoC known
7.5
8.9
Published
2026-04-15 09:05 UTC
CWE-385
Weakness classes (CWE)
CWE-385Base
Covert Timing Channel
Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
cwe.mitre.org →
Description
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Source: EUVD
References & sources
- https://nvd.nist.gov/vuln/detail/CVE-2026-5598advisory
- https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5web
- https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87web
- https://github.com/bcgit/bc-javapackage
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598web
- https://github.com/bcgit/bc-java/wiki/CVE-2026-5598web