CVE-2026-5598 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-5598 PUBLISHED CVSS 10 CRITICAL

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). Non-constant time comparisons risk private key leakage in FrodoKEM. This issue affects BC-JAVA: from 2.17.3 before 1.84.

EPSS 0.04% · 13.8th percentile

Risk Scores

CVSS v4.0

10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS Score

0.04%

13.8th percentile

Affected Products

Vendor	Product	Versions
Legion of the Bouncy Castle Inc.	BC-JAVA	2.17.3

Timeline

Apr 15, 2026 CVE Published
Apr 15, 2026 PoC Published
Apr 16, 2026 EPSS Score
Apr 21, 2026 CVE Updated
Apr 30, 2026 Distribution Patch
Apr 30, 2026 Security Advisory
Apr 30, 2026 Distribution Patch
Apr 30, 2026 Security Advisory
Apr 30, 2026 Security Advisory

References

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998 url

Open in Interactive Console →