CVE-2026-5598

CRITICAL

Non-constant time comparisons risk private key leakage in FrodoKEM.

Title source: cna

Description

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.84.

References (4)

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998

[Vendor Advisory] https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598

[Patch] https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87

[Patch] https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5

View Patch ZIP pw:eip

Scores

CVSS v4 10.0

EPSS 0.0002

EPSS Percentile 4.8%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Details

CWE

CWE-385

Status published

Products (2)

Legion of the Bouncy Castle Inc./BC-JAVA 1.71 - 1.84

Legion of the Bouncy Castle Inc./BC-JAVA 2.17.3 - 1.84

Published Apr 15, 2026

Tracked Since Apr 15, 2026