Is Java affected by CVE-2026-5598?

CVE-2026-5598 is a critical timing side-channel vulnerability in Bouncy Castle BC-JAVA cryptographic library (versions 1.74-1.83) that allows remote attackers to extract FrodoKEM private keys through statistical analysis of operation timing.

CVE-2026-5598

EUVD-2026-22872 CRITICAL

2026-04-15 bcorg

Java Information Disclosure

10.0

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:34 vuln.today

v2 (patch_released)

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

patch_available

Apr 16, 2026 - 05:29 EUVD

1.84

Analysis Generated

Apr 15, 2026 - 12:38 vuln.today

DescriptionNVD

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). Non-constant time comparisons risk private key leakage in FrodoKEM.

This issue affects BC-JAVA: from 2.17.3 before 1.84.

AnalysisAI

Non-constant time comparison operations in the Legion of the Bouncy Castle BC-JAVA cryptographic library (core modules, versions 2.17.3 through 1.83) expose FrodoKEM private keys to timing side-channel attacks, enabling remote unauthenticated attackers to extract cryptographic secrets through statistical analysis of operation timing variations. CVSS 4.0 score of 10.0 reflects maximum confidentiality and integrity impact across system and subsequent contexts. …

RemediationAI

Within 24 hours: Identify all applications and systems using BC-JAVA versions 1.74-1.83 via dependency scanning and software inventory. Within 7 days: Upgrade BC-JAVA to version 1.84 or later across all identified instances; prioritize systems handling FrodoKEM keys or other post-quantum cryptography operations. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-5598 vulnerability details – vuln.today

Back

CVE-2026-5598

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Analysis

Full analysis requires sign-in

Share

CVE-2026-5598

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code