Skip to content
fr Sign in
8.9 High

CVE-2026-5598 Covert timing channel vulnerability in Legion of the Bouncy Castle Inc

Description

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Affected products and versions

Product Affected versions Fixed in
BC-JAVA 1.82 1.82 → < 1.84 1.84
BC-JAVA 1.81 1.81 → < 1.81.1 1.81.1
BC-JAVA 1.71 1.71 → < 1.80.2 1.80.2
Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server Versions not published
Red Hat JBoss EAP 7.4 ELS for RHEL 8 Versions not published
Red Hat JBoss EAP 8.1 for RHEL 8 Versions not published
Red Hat JBoss EAP 7.4 ELS for RHEL 9 Versions not published
Red Hat JBoss EAP 8.1 for RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Show the 32 other branches
Product Affected versions Fixed in
Red Hat JBoss Enterprise Application Platform 8.1 Versions not published
Red Hat Fuse 7 Versions not published
Cryostat 4 Versions not published
OpenShift Developer Tools and Services Versions not published
Red Hat AMQ Broker 7 Versions not published
Red Hat AMQ Clients Versions not published
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat build of Apicurio Registry 3 Versions not published
Red Hat build of Debezium 2 Versions not published
Red Hat build of Debezium 3 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Single Sign-On 7 Versions not published
streams for Apache Kafka 2 Versions not published
streams for Apache Kafka 3 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4.25 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1.7.GA 1.84 earliest → < 1.84.0.redhat-00001 1.84.0.redhat-00001

References

Timeline

  1. Published
  2. Last modified

Other CVEs of BC-JAVA

The 52 CVEs of BC-JAVA →
CVE-2026-71890 In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list,… 8.7 High CVE-2026-71891 In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every… 7.1 High CVE-2026-18040 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8)… 5.9 Medium CVE-2026-71885 In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509… 9.2 Critical
Track this CVE