{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.bouncycastle:bcprov-jdk15to18",
        "purl": "pkg:maven/org.bouncycastle/bcprov-jdk15to18"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.71"
            },
            {
              "fixed": "1.80.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.71",
        "1.72",
        "1.73",
        "1.74",
        "1.75",
        "1.76",
        "1.77",
        "1.78",
        "1.78.1",
        "1.79",
        "1.80"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.bouncycastle:bcprov-jdk14",
        "purl": "pkg:maven/org.bouncycastle/bcprov-jdk14"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.71"
            },
            {
              "fixed": "1.84"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.71",
        "1.72",
        "1.73",
        "1.74",
        "1.75",
        "1.76",
        "1.77",
        "1.78",
        "1.78.1",
        "1.79",
        "1.80",
        "1.81",
        "1.82",
        "1.83"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.bouncycastle:bcprov-jdk18on",
        "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.82"
            },
            {
              "fixed": "1.84"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.82",
        "1.83"
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "< 1.81.1",
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.bouncycastle:bcprov-jdk18on",
        "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.81"
            },
            {
              "fixed": "1.84"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.81",
        "1.81.1",
        "1.82",
        "1.83"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.bouncycastle:bcprov-jdk18on",
        "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.71"
            },
            {
              "fixed": "1.80.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.71",
        "1.71.1",
        "1.72",
        "1.73",
        "1.74",
        "1.75",
        "1.76",
        "1.77",
        "1.78",
        "1.78.1",
        "1.79",
        "1.80"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-5598"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-385"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-25T23:25:24Z",
    "nvd_published_at": "2026-04-15T10:16:49Z",
    "severity": "HIGH"
  },
  "details": "Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java.\n\nThis issue only affects users of the FrodoKEM algorithm involved in the decryption of encapsulations.\n\nThis issue affects BC-JAVA: from 1.71 to 1.80.1, 1.81, 1.82 to 1.83.\n\nFixed versions: 1.80.2, 1.81.1, 1.84",
  "id": "GHSA-p93r-85wp-75v3",
  "modified": "2026-11-04T03:30:49.735916365Z",
  "published": "2026-04-17T18:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-5598"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bcgit/bc-java"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458635"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-5598"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:53806"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:53646"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:53645"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:53644"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:18059"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:18055"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:18054"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:12269"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:12267"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:P/AU:Y/U:Red",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Bouncy Castle Has Covert Timing Channel Vulnerability"
}