CVE-2026-5598 Non-constant time comparisons risk private key leakage in FrodoKEM.

🗓️ 15 Apr 2026 09:05:56Reported by bcorgType

Non-constant time checks leak private keys in Frodo KEM; covert timing channel in Bouncy Castle Java core.

Reporter	Title	Published	Views	Family All 124
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in Bouncy Castle Crypto (CVE-2025-14813, CVE-2026-5598)	21 May 202615:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-3505, CVE-2025-14813, CVE-2026-0636, CVE-2026-5598, CVE-2026-33671, CVE-2026-33672, CVE-2026-5588, CVE-2026-40175)	8 Jun 202613:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in Bouncy Castle bcprov-jdk (CVE-2025-14813, CVE-2026-5598)	27 May 202614:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j and Bouncy Castle.	11 May 202606:59	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in bcprov-jdk18on-1.81.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-14813)	29 May 202609:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Technical Support Appliance is affected by a timing channel vulnerability in Bouncy Castle BC-JAVA	8 Jun 202614:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition	11 Jun 202612:09	–	ibm
ATTACKERKB	CVE-2026-5598	15 Apr 202609:05	–	attackerkb
Atlassian	Covert timing channel at org.bouncycastle:bcprov-jdk18on dependency in Bamboo Data Center	11 May 202623:29	–	atlassian
Atlassian	Covert timing channel vulnerability at Bouncy Castle dependency at Crucible Server	11 May 202623:29	–	atlassian

[
  {
    "vendor": "Legion of the Bouncy Castle Inc.",
    "product": "BC-JAVA",
    "platforms": [
      "all"
    ],
    "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
    "packageName": "core",
    "repo": "https://github.com/bcgit/bc-java",
    "modules": [
      "core"
    ],
    "programFiles": [
      "FrodoEngine.java"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.71",
        "lessThan": "1.80.2",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "1.81",
        "lessThan": "1.80.1",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "1.82",
        "lessThan": "1.84",
        "versionType": "maven"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598
github	www.github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5
github	www.github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87

18 May 2026 23:17Current

CVSS 49.9

EPSS0.00022

CWE-385