Bouncy Castle Has Covert Timing Channel Vulnerability

🗓️ 17 Apr 2026 18:31:50Reported by GitHub Advisory DatabaseType

Covert timing channel vulnerability in Bouncy Castle Java core modules affecting FrodoEngine.java; versions 1.71 through before 1.84.

Reporter	Title	Published	Views	Family All 157
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in Bouncy Castle Crypto (CVE-2025-14813, CVE-2026-5598)	21 May 202615:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-3505, CVE-2025-14813, CVE-2026-0636, CVE-2026-5598, CVE-2026-33671, CVE-2026-33672, CVE-2026-5588, CVE-2026-40175)	8 Jun 202613:55	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Use of a Broken or Risky Cryptographic Algorithm, Covert Timing Channel (CVE-2025-14813, CVE-2026-5598)	16 Jun 202614:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues	27 Jul 202606:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in Bouncy Castle bcprov-jdk (CVE-2025-14813, CVE-2026-5598)	27 May 202614:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	1 Jul 202617:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues	28 Jul 202617:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® is affected by vulnerabilities in bcprov-jdk18on-1.82 and bcpkix-jdk18on-1.82.	23 Jun 202619:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by broken or risky algorithm.	17 Jun 202606:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability affect cryptography-46.0.5, and bcprov-jdk18on-1.82.jar IBM COS Systems (July 2026)	14 Jul 202615:47	–	ibm

Vulners

Node

org.bouncycastle bcprov-jdk18onRange1.82–1.84maven

org.bouncycastle bcprov-jdk14Range1.81–1.81.1maven

org.bouncycastle bcprov-jdk15to18Range1.71–1.80.2maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-5598
github	www.github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5
github	www.github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87
github	www.github.com/bcgit/bc-java/wiki/CVE-2026-5598
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598
github	www.github.com/advisories/GHSA-p93r-85wp-75v3

19 Jun 2026 15:20Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

CVSS 49.9

EPSS0.00691

SSVC

CWE-385