ghsa-p93r-85wp-75v3
CVSS 8.9 osv_maven
Description
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue only affects users of the FrodoKEM algorithm involved in the decryption of encapsulations. This issue affects BC-JAVA: from 1.71 to 1.80.1, 1.81, 1.82 to 1.83. Fixed versions: 1.80.2, 1.81.1, 1.84
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-5598
- https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87
- https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json
- https://github.com/bcgit/bc-java/wiki/CVE-2026-5598
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598
- https://github.com/bcgit/bc-java
- https://bugzilla.redhat.com/show_bug.cgi?id=2458635
- https://access.redhat.com/security/cve/CVE-2026-5598
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:12269
- https://access.redhat.com/errata/RHSA-2026:12267
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk15to18",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk15to18"
},
"ranges": [
{
"events": [
{
"introduced": "1.71"
},
{
"fixed": "1.80.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.71",
"1.72",
"1.73",
"1.74",
"1.75",
"1.76",
"1.77",
"1.78",
"1.78.1",
"1.79",
"1.80"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk14",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk14"
},
"ranges": [
{
"events": [
{
"introduced": "1.71"
},
{
"fixed": "1.84"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.71",
"1.72",
"1.73",
"1.74",
"1.75",
"1.76",
"1.77",
"1.78",
"1.78.1",
"1.79",
"1.80",
"1.81",
"1.82",
"1.83"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk18on",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on"
},
"ranges": [
{
"events": [
{
"introduced": "1.82"
},
{
"fixed": "1.84"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.82",
"1.83"
]
},
{
"database_specific": {
"last_known_affected_version_range": "< 1.81.1",
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk18on",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on"
},
"ranges": [
{
"events": [
{
"introduced": "1.81"
},
{
"fixed": "1.84"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.81",
"1.81.1",
"1.82",
"1.83"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk18on",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on"
},
"ranges": [
{
"events": [
{
"introduced": "1.71"
},
{
"fixed": "1.80.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.71",
"1.71.1",
"1.72",
"1.73",
"1.74",
"1.75",
"1.76",
"1.77",
"1.78",
"1.78.1",
"1.79",
"1.80"
]
}
],
"aliases": [
"CVE-2026-5598"
],
"database_specific": {
"cwe_ids": [
"CWE-385"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-25T23:25:24Z",
"nvd_published_at": "2026-04-15T10:16:49Z",
"severity": "HIGH"
},
"details": "Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java.\n\nThis issue only affects users of the FrodoKEM algorithm involved in the decryption of encapsulations.\n\nThis issue affects BC-JAVA: from 1.71 to 1.80.1, 1.81, 1.82 to 1.83.\n\nFixed versions: 1.80.2, 1.81.1, 1.84",
"id": "GHSA-p93r-85wp-75v3",
"modified": "2026-11-04T03:30:49.735916365Z",
"published": "2026-04-17T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-5598"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598"
},
{
"type": "PACKAGE",
"url": "https://github.com/bcgit/bc-java"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458635"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-5598"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53646"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53645"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:18055"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:18054"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:12269"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:12267"
}
],
"schema_version": "1.9.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:P/AU:Y/U:Red",
"type": "CVSS_V4"
}
],
"summary": "Bouncy Castle Has Covert Timing Channel Vulnerability"
}