{"id":"CVE-2026-5598","kind":"vulnerability","aliases":["CVE-2026-5598","GHSA-p93r-85wp-75v3"],"related":[],"title":"Bouncy Castle Has Covert Timing Channel Vulnerability","description":"Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java.\n\nThis issue only affects users of the FrodoKEM algorithm involved in the decryption of encapsulations.\n\nThis issue affects BC-JAVA: from 1.71 to 1.80.1, 1.81, 1.82 to 1.83.\n\nFixed versions: 1.80.2, 1.81.1, 1.84","summary":"Bouncy Castle's Java FrodoKEM implementation leaks timing information during decryption of encapsulations. An attacker who can time many decryptions may recover information about the secret key.","severity":"high","cvss":8.9,"epss":0.00899,"exploited":false,"exploited_at":null,"products":[{"name":"org.bouncycastle:bcprov-jdk15to18","fixed":["1.80.2"],"affected":">= 1.71, < 1.80.2","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk18on","fixed":["1.84"],"affected":">= 1.82, < 1.84","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk14","fixed":["1.84"],"affected":">= 1.71, < 1.84","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk18on","fixed":["1.84"],"affected":">= 1.81, < 1.81.1","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk18on","fixed":["1.80.2"],"affected":">= 1.71, < 1.80.2","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["bouncy-castle","cwe-385","java","maven","package","post-quantum-crypto"],"not_affected_if":["no-frodokem","other-algorithms-only"],"how_to_check":"- Check the Bouncy Castle version in your Maven or Gradle dependencies, for example with `mvn dependency:tree | grep bouncycastle`\n- Confirm whether your code uses the FrodoKEM algorithm for decrypting encapsulations; the sources say only users of FrodoKEM are affected","fix":"- `bcprov-jdk15to18` to `1.80.2`\n- `bcprov-jdk18on` to `1.80.2` for the 1.71 to 1.80.1 range, `1.84` for the 1.81 and 1.82 to 1.83 ranges\n- `bcprov-jdk14` to `1.84`","status":"open","published_at":"2026-04-15T10:16:49+00:00","first_seen_at":"2026-11-04T03:21:06+00:00","triaged_at":"2026-11-04T03:22:18+00:00","updated_at":"2026-11-04T03:46:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T03:22:18Z","model":"claude-haiku-5-5","output":{"fix":"- `bcprov-jdk15to18` to `1.80.2`\n- `bcprov-jdk18on` to `1.80.2` for the 1.71 to 1.80.1 range, `1.84` for the 1.81 and 1.82 to 1.83 ranges\n- `bcprov-jdk14` to `1.84`","reach":"unknown","title":"Bouncy Castle: FrodoKEM decryption leaks secrets through a timing side channel","impact":"medium","summary":"Bouncy Castle's Java FrodoKEM implementation leaks timing information during decryption of encapsulations. An attacker who can time many decryptions may recover information about the secret key.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","bouncy-castle","maven","post-quantum-crypto"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker recovers secret key material via timing measurements","analyst_note":"","how_to_check":"- Check the Bouncy Castle version in your Maven or Gradle dependencies, for example with `mvn dependency:tree | grep bouncycastle`\n- Confirm whether your code uses the FrodoKEM algorithm for decrypting encapsulations; the sources say only users of FrodoKEM are affected","plain_action":"","needs_analyst":false,"not_affected_if":["no-frodokem","other-algorithms-only"],"who_is_affected":"Only applications that use the FrodoKEM algorithm to decrypt encapsulations with Bouncy Castle's Java library are affected. Applications that use other algorithms, or that do not use FrodoKEM decryption, are not affected by the sources' description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000762,"input_tokens":4490,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':9A,17A '-385':43B '-5598':10A,18A '1.71':127C '1.80.1':129C '1.80.2':136C '1.81':130C '1.81.1':137C '1.82':131C '1.83':133C '1.84':138C '75v3':15A '85wp':14A 'affect':108C,122C 'algorithm':113C 'associ':100C 'attack':65B 'bc':90C,124C 'bc-java':89C,123C 'bcprov':21A,25A,29A,33A,37A 'bcprov-jdk14':28A 'bcprov-jdk15to18':20A 'bcprov-jdk18on':24A,32A,36A 'bounci':1A,40B,51B,86C 'bouncy-castl':39B 'castl':2A,41B,52B,87C 'channel':6A,80C 'core':92C,95C 'covert':4A,78C 'crypto':50B 'cve':8A,16A 'cwe':42B 'decrypt':61B,70B,117C 'encapsul':63B,119C 'file':103C 'fix':134C 'frodoengine.java':104C 'frodokem':55B,112C 'ghsa':12A 'ghsa-p93r-85wp-75v3':11A 'implement':56B 'inc':88C 'inform':59B,73B 'involv':114C 'issu':106C,121C 'java':44B,54B,91C,125C 'jdk14':30A 'jdk15to18':22A 'jdk18on':26A,34A,38A 'key':77B 'leak':57B 'legion':83C 'mani':69B 'maven':45B 'may':71B 'modul':96C 'org.bouncycastle':19A,23A,27A,31A,35A 'p93r':13A 'packag':46B 'post':48B 'post-quantum-crypto':47B 'program':102C 'quantum':49B 'recov':72B 'secret':76B 'time':5A,58B,68B,79C 'user':109C 'version':135C 'vulner':7A,81C,98C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use the FrodoKEM algorithm to decrypt encapsulations with Bouncy Castle's Java library are affected. Applications that use other algorithms, or that do not use FrodoKEM decryption, are not affected by the sources' description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["orgbouncycastlebcprovjdk14","orgbouncycastlebcprovjdk15to18","orgbouncycastlebcprovjdk18on"],"ptokens":["bcprov","bouncycastle","jdk14","jdk15to18","jdk18on","org"],"labels":["bouncycastle","cwe385","high","java","maven","package","postquantumcrypto"],"campaign_type":null,"first_public_at":"2026-04-15T10:16:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-p93r-85wp-75v3","url":"https://github.com/advisories/GHSA-p93r-85wp-75v3","severity":"high","published_at":"2026-04-17T18:31:50+00:00","modified_at":"2026-11-04T03:20:47+00:00","first_seen_at":"2026-11-04T03:21:06+00:00","fetched_at":"2026-11-04T03:26:16+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-5598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5598","severity":null,"published_at":"2026-04-15T10:16:49+00:00","modified_at":"2026-10-26T21:10:00+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","fetched_at":"2026-11-04T03:46:40+00:00","note":null}],"documents":[{"id":1328,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55981","title":"NVD CVE-2026-55981","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":63568,"url":"https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63569,"url":"https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}