HIGHCVSS 8.9EPSS 0.9%

CVE-2026-5598

CVE-2026-5598 updated by NVD

Published: 2026-04-17
Modified: 2026-11-04
EPSS percentile: 60%
Sources: github-advisory, nvd

Summary

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.bouncycastle:bcprov-jdk14	—	1.84
Maven	org.bouncycastle:bcprov-jdk15to18	—	1.80.2
Maven	org.bouncycastle:bcprov-jdk18on	—	1.84, 1.80.2

Remediation: Upgrade to 1.84 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-5598

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.