GitHub Advisoryadvisory · Maven

GHSA-p93r-85wp-75v3 Bouncy Castle Has Covert Timing Channel Vulnerability

HIGH Published 2026-04-17 Modified 2026-06-19 Official page ↗
Aliases
CVE-2026-5598
Ecosystem
Maven
Packages
org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk18on
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:P/AU:Y/U:Red
Weaknesses
CWE-385
Reviewed
2026-04-25

Affected packages

• Maven org.bouncycastle:bcprov-jdk15to18: >= 1.71, < 1.80.2 → fixed in 1.80.2 • Maven org.bouncycastle:bcprov-jdk14: >= 1.81, < 1.81.1 → fixed in 1.81.1 • Maven org.bouncycastle:bcprov-jdk18on: >= 1.82, < 1.84 → fixed in 1.84

Description

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue only affects users of the FrodoKEM algorithm involved in the decryption of encapsulations. This issue affects BC-JAVA: from 1.71 to 1.80.1, 1.81, 1.82 to 1.83. Fixed versions: 1.80.2, 1.81.1, 1.84

Related

Alias · CVE (1)

  • CVE-2026-5598 Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. vulnerability

Weakness · CWE (1)

  • CWE-385 Covert Timing Channel weakness

References