CVE-2026-5598
Timing Channel Vulnerability in BC-JAVA FrodoKEM Risks Key Leakage
Publication date: 2026-04-15
Last updated on: 2026-04-21
Assigner: bcorg
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| legion_of_the_bouncy_castle_inc | bc-java | From 2.17.3 (inc) to 1.84 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-385 | Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves a covert timing channel in BC-JAVA's core modules that risks private key leakage due to non-constant time comparisons in FrodoKEM.
Such private key leakage can potentially lead to unauthorized access or data breaches, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding sensitive information.
However, the provided context and resources do not explicitly discuss the direct impact of this vulnerability on compliance with these standards.
Can you explain this vulnerability to me?
This vulnerability is a covert timing channel issue in the Legion of the Bouncy Castle Inc. BC-JAVA core modules. It arises because certain cryptographic operations, specifically comparisons, are not performed in constant time. This non-constant time comparison can leak information about private keys used in the FrodoKEM algorithm, potentially allowing attackers to infer sensitive cryptographic material.
How can this vulnerability impact me? :
The impact of this vulnerability is severe as it can lead to the leakage of private cryptographic keys through timing analysis attacks. An attacker exploiting this flaw could recover private keys used in FrodoKEM, compromising the confidentiality and integrity of encrypted communications or data protected by these keys. This could result in unauthorized data access, data breaches, or the ability to impersonate legitimate users or systems.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade BC-JAVA to a version after 1.84, as the issue affects versions from 2.17.3 before 1.84.