CVE-2026-5598Non-constant time comparisons risk private key leakage in FrodoKEM.
Updated under an hour ago ()
Does this affect you?
It affects Legion of the Bouncy Castle Inc. BC-JAVA and 22 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
- CVSS
- 8.9 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:P/AU:Y/U:Red
- Weakness (CWE)
- CWE-385
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- bcorg
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Legion of the Bouncy Castle Inc. BC-JAVA legion_of_the_bouncy_castle:bc_java (from the name) | from 1.71 before 1.80.2; from 1.81 before 1.81.1; from 1.82 before 1.84 | CNA record |
Red Hat Red Hat JBoss Enterprise Application Platform 7 redhat:jboss_enterprise_application_platform | 7.4 | CISA ADP |
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 redhat:jboss_enterprise_application_platform_els | from 0:1.84.0-1.redhat_00001.1.el7eap not affected | CISA ADP |
Red Hat Cryostat 4 redhat:cryostat | 4 | CISA ADP |
Red Hat OpenShift Developer Tools and Services redhat:ocp_tools | Versions not stated | CISA ADP |
Red Hat Red Hat AMQ Broker 7 redhat:amq_broker | 7 | CISA ADP |
Red Hat Red Hat AMQ Clients redhat:amq_clients | 2023 | CISA ADP |
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 redhat:camel_quarkus | 3 | CISA ADP |
Red Hat Red Hat build of Apache Camel for Spring Boot 4 redhat:camel_spring_boot | 4 | CISA ADP |
Red Hat Red Hat build of Apicurio Registry 3 redhat:apicurio_registry | 3 | CISA ADP |
Red Hat Red Hat build of Debezium 2 redhat:debezium | 2 | CISA ADP |
Red Hat Red Hat Build of Keycloak redhat:build_keycloak | Versions not stated | CISA ADP |
Red Hat Red Hat build of Quarkus redhat:quarkus | 3 | CISA ADP |
Red Hat Red Hat Data Grid 8 redhat:jboss_data_grid | 8 | CISA ADP |
Red Hat Red Hat Enterprise Linux 8 redhat:enterprise_linux | 8 | CISA ADP |
Red Hat Red Hat Fuse 7 redhat:jboss_fuse | 7 | CISA ADP |
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack redhat:jbosseapxp | Versions not stated | CISA ADP |
Red Hat Red Hat OpenShift AI (RHOAI) redhat:openshift_ai | Versions not stated | CISA ADP |
Red Hat Red Hat OpenShift Dev Spaces redhat:openshift_devspaces | 3 | CISA ADP |
Red Hat Red Hat Process Automation 7 redhat:jboss_enterprise_bpms_platform | 7 | CISA ADP |
Red Hat Red Hat Satellite 6 redhat:satellite | 6 | CISA ADP |
Red Hat Red Hat Single Sign-On 7 redhat:red_hat_single_sign_on | 7 | CISA ADP |
Red Hat streams for Apache Kafka 2 redhat:amq_streams | 2 | CISA ADP |
References
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598vendor-advisory
- https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87patch
- https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5patch
- https://access.redhat.com/errata/RHSA-2026:12267
- https://access.redhat.com/errata/RHSA-2026:12269
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/security/cve/CVE-2026-5598
- https://bugzilla.redhat.com/show_bug.cgi?id=2458635
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.