~ / search / GHSA-p93r-85wp-75v3

GHSA-p93r-85wp-75v3

Bouncy Castle Has Covert Timing Channel Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2026-5598

Packages

EcosystemPackageAffectedFixed in
Maven org.bouncycastle:bcprov-jdk15to18 >= 1.71, < 1.80.2 1.80.2
Maven org.bouncycastle:bcprov-jdk14 >= 1.71, < 1.84 1.84
Maven org.bouncycastle:bcprov-jdk18on >= 1.82, < 1.84 1.84
Maven org.bouncycastle:bcprov-jdk18on >= 1.81, < 1.84 1.84
Maven org.bouncycastle:bcprov-jdk18on >= 1.71, < 1.80.2 1.80.2

Details

As written in the advisory (Markdown source, shown as plain text).

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue only affects users of the FrodoKEM algorithm involved in the decryption of encapsulations. This issue affects BC-JAVA: from 1.71 to 1.80.1, 1.81, 1.82 to 1.83. Fixed versions: 1.80.2, 1.81.1, 1.84

References

External links from the advisory. They lead to third-party sites.