--- id: CVE-2026-5598 title: Covert timing channel vulnerability in Legion of the Bouncy Castle Inc summary: >- Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, f… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N' cwe: - CWE-385 vendor: Legion of the Bouncy Castle Inc. product: core affected: - core >= 1.71 < 1.80.2 - core >= 1.81 < 1.81.1 - core >= 1.82 < 1.84 published: '2026-04-15' updated: '2026-09-18' sourceUpdated: '2026-09-18T13:18:34.963' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5598' references: - url: >- https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5 label: 91579145-5d7b-4cc5-b925-a0262ff19630 - url: >- https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87 label: 91579145-5d7b-4cc5-b925-a0262ff19630 - url: 'https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598' label: 91579145-5d7b-4cc5-b925-a0262ff19630 - url: 'https://access.redhat.com/errata/RHSA-2026:12267' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:12269' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18054' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18055' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18059' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:53644' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:53645' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:53646' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-5598' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2458635' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-5598' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5598' - url: 'https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.00899 epssPercentile: 0.58145 ssvc: exploitation: none automatable: 'yes' technicalImpact: total timestamp: '2026-04-15T13:11:48.318645Z' scores: nvd: 7.5 cna: 8.9 vendor: 7.5 ingestedAt: '2026-09-14T15:23:07.439Z' patched: - jboss_eap_7_4_els_for_rhel_7_server - jboss_eap_7_4_els_for_rhel 8 - jboss_eap_8_1_for_rhel 8 - jboss_eap_7_4_els_for_rhel 9 - jboss_eap_8_1_for_rhel 9 - jboss_enterprise_application_platform 7 - jboss_enterprise_application_platform 8.1.7.GA --- ## Overview Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:53644** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53644) - **RHSA-2026:12267** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server, Red Hat JBoss EAP 7.4 ELS for RHEL 8, Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12267) - **RHSA-2026:53645** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 8 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53645) - **RHSA-2026:18054** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 8 · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18054) - **RHSA-2026:53646** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53646) - **RHSA-2026:18055** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 9 · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18055) - **RHSA-2026:12269** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7 · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12269) - **RHSA-2026:18059** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 8.1.7.GA · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18059) - **Red Hat VEX** · Important · affected: Red Hat Fuse 7 · no fix planned: Red Hat Fuse 7 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json)