CVE-2026-5598
Aliases:GHSA-p93r-85wp-75v3RHSA-2026:12267DEBIAN-CVE-2026-5598CGA-22m7-5xj6-cqgmCGA-24wc-3w7v-g772CGA-27qw-px56-4534CGA-2c7m-qpjq-492xCGA-2vq5-q73h-wfgpCGA-368v-4wvr-vcchCGA-36xw-pqv7-gg98CGA-39q5-v7r5-v7wpCGA-3jxr-r7x6-g447CGA-3q9j-r893-qgxmCGA-47gf-hrjh-8j47CGA-4r3h-rmp7-qxxjCGA-4vq8-9pfx-6rpwCGA-55j4-qqwp-38j7CGA-583f-cwm8-cmw5CGA-585j-3hv7-4m65CGA-58r2-vgpw-gwcxCGA-59qw-4cfj-254hCGA-5h6v-3j53-58gwCGA-5hc7-3vpc-px2mCGA-5jq7-c5v9-2q9vCGA-5r8q-v3mf-xw3fCGA-5w6v-jfx9-mmw6CGA-6655-4vgr-jvcmCGA-66vj-v4v9-m5x3CGA-6934-2q95-ccm5CGA-6cv2-rm9j-h5p7CGA-6f2j-p3m5-6h42CGA-6j74-v6c4-85qrCGA-6jch-3vjc-33wrCGA-726q-hhxv-8266CGA-7mmv-6xmm-84q3CGA-7p5m-fr56-2hr2CGA-864f-wj59-64p9CGA-8gm2-79hv-vw82CGA-8rp5-v9v9-5jhvCGA-8wmq-v7g6-29fwCGA-9pgh-9j28-6pv9CGA-cfqm-53q6-fw36CGA-cfv7-v2jh-j3gwCGA-chx8-2qrv-9577CGA-f6f6-g6hj-w7cmCGA-f876-hm74-gj9gCGA-fp6h-8hp6-9c2mCGA-fvqg-gm5w-hhwqCGA-fx24-fwpc-4r7pCGA-g33c-j67j-3m2fCGA-g3mh-rmm9-qc9pCGA-g65x-6hv5-pvrvCGA-g837-95w8-pmxwCGA-g8cv-49h3-rmpfCGA-g9cq-rx9f-7f37CGA-gp2f-5744-v3m9CGA-gr79-wc6m-7xwpCGA-gvxx-chwq-jm6vCGA-h56q-46rg-x8g5CGA-h9xv-qc5p-2mg2CGA-hc4j-98g4-549jCGA-hg9p-4ccc-mp9fCGA-hhrq-9r3q-jwjhCGA-hq26-jvhw-cv38CGA-hxf3-cp3c-hw35CGA-j7g5-68fh-4j5rCGA-j86p-vhx9-vrv8CGA-jcpm-79wv-85qjCGA-jg74-36ww-pxr9CGA-jhpg-4c8r-rgrhCGA-jm4p-xq2x-wcfxCGA-m9c4-f3j6-fx28CGA-m9h8-5gw5-xpp5CGA-mqf9-pgxr-fj23CGA-mvvx-35vw-mfp4CGA-p49w-v784-76x5CGA-pggh-fm9h-h274CGA-pq28-88vj-w5vqCGA-prr7-759q-4f8rCGA-24h6-97pm-jwp7CGA-24h6-9hc8-v97pCGA-2576-wc2q-m3w7CGA-29gx-2822-fj4cCGA-2gmp-3hhm-qp4qCGA-2h5x-6xxv-3vfrCGA-2jcj-23j5-mcqhCGA-2mq9-r8p8-54xqCGA-2q39-2hv3-g68xCGA-2rg7-c8f9-cgm9CGA-2vf7-r637-gmw3CGA-2wrm-7mcv-x29wCGA-32qj-84jh-fx36CGA-32r8-w827-hm2cCGA-3432-fvgp-5v89CGA-382x-jp57-vvp8CGA-39x5-mpx2-r734CGA-3f3j-fh53-fjf3CGA-3f42-m2w4-fgmwCGA-3p3j-xmq8-qx95CGA-3v67-rf7h-7jp5CGA-3vvx-6p54-c4f7CGA-44jv-g448-qq3pCGA-4c5m-g872-72xqCGA-4c63-2wf7-qh66CGA-4f5f-6h23-p45pCGA-4rrw-g628-mwrfCGA-4v3v-wv83-jxgcCGA-4wjj-fq85-pvx9CGA-54hh-2xrq-hpw8CGA-56x2-9f62-jc8hCGA-5ch9-5ww5-8cw5CGA-5g4m-2775-5875CGA-5jgx-qhjh-4f76CGA-5p6w-q79m-hg37CGA-5qrq-c2pg-fm38CGA-5qv6-685r-4g54CGA-63f7-m76r-vw6pCGA-63hh-rr8g-f43gCGA-656g-63vp-5qp4CGA-679w-gp85-93g2CGA-699x-r3xm-6w34CGA-6c3q-mwfh-27g9CGA-6cfw-vh9x-pf28CGA-6frw-vrc4-8344CGA-6jp4-c673-xpq8CGA-6m24-3prp-vvg7CGA-72jf-4mxx-pjj8CGA-7569-ghxc-q9gqCGA-7673-4hc4-9jjjCGA-7682-m6hm-j5p7CGA-77vq-h842-w824CGA-78v7-46wx-vgwgCGA-793q-hwxp-86f6CGA-7c6w-pj4v-94wxCGA-7g27-5w42-493cCGA-7gc9-wwh6-hwv7CGA-7jfm-v9jj-x8hpCGA-7mh6-6rg3-p542CGA-7rhg-55p7-rv45CGA-7vf8-4c9v-4g3wCGA-7w94-f6wj-p573CGA-83w9-92m7-hjg2CGA-847g-j2hm-xhhfCGA-84ww-8267-76x7CGA-87pf-mr8q-84jvCGA-888h-6q35-55frCGA-88pq-5hw2-8gjhCGA-8crf-fg67-3pgpCGA-8ggv-8g35-2wc8CGA-8h58-v349-748wCGA-8hgc-55c9-fw3vCGA-8j58-9p62-9h5wCGA-8p29-f8rx-prf4CGA-8pxg-5mhm-84pjCGA-8wf2-qxvq-rgw7CGA-93xj-m69q-qrpmCGA-94xc-ccjq-wrxcCGA-9f67-jp6x-jm9jCGA-9hmg-jp84-fm9pCGA-9hvg-9p52-xqp4CGA-9xq3-hwcc-r8j9CGA-c22p-vfg7-823vCGA-c2c6-c5vm-m6vqCGA-c2cf-f8v3-383wCGA-c6ph-j35w-2wp3CGA-c85v-mg7j-23pwCGA-c95w-jhx4-jh94CGA-cgv7-gf5f-rcpgCGA-f3p7-h2q2-fr5gCGA-f4jp-v5mc-5925CGA-f4w5-xcj9-qchfCGA-f837-763g-q4qvCGA-f99f-84r6-797gCGA-fgx4-vmrj-qc8xCGA-fjfv-rc2c-c59fCGA-fmcq-jwjp-mc6mCGA-fmjv-53rm-5hrhCGA-fpwq-928v-p285CGA-frvj-5fwc-gj33CGA-frvp-qx6c-8674CGA-fw94-wwr6-9v8hCGA-fx2p-jfj3-fgrpCGA-g2m7-h9pp-vx74CGA-g5hw-c999-jwgjCGA-gr8r-vcvr-pcgcCGA-h3pq-3vmw-q594CGA-h7v4-2v7c-mgrhCGA-h94j-667q-whvfCGA-hc5x-rmvc-q8jrCGA-hpg2-gwpr-w4w6CGA-hwp3-h2jm-fmwjCGA-hx95-4px2-8grmCGA-j3vg-4vx4-gx2wCGA-j5wp-q6fg-gqhvCGA-j7rw-xjv6-jggvCGA-jcr4-94ph-jf6qCGA-jff7-x6m7-5pcxCGA-jg88-fp49-9h3rCGA-jgc4-6h3w-xpvxCGA-jh88-278g-3pq6CGA-jj2p-76rj-jm6fCGA-jqcq-gjmf-m5rvCGA-jr5c-6qq7-x6vwCGA-jv9v-3423-4x3pCGA-jw46-mwjm-q2c8CGA-jx57-qgj4-5gr4CGA-m2qm-vj2f-9fqfCGA-m444-55mp-v9w8CGA-m47h-993q-6rrxCGA-m849-3wg6-3629CGA-mm7h-r532-hr6wCGA-mw8g-5rf4-jxg2CGA-mww9-cvp7-6q8rCGA-p3gm-gp42-qrv4CGA-p3gv-m222-9cjmCGA-p43v-5mmm-h999CGA-p68p-6vw9-8f2qCGA-p9p6-jwjg-h3xjCGA-p9xm-jv7q-8ffvCGA-pg9j-93cg-qhmmCGA-pqq9-cp8w-j9m4CGA-q2hq-378h-jgcwCGA-q5xp-wp9p-cqxrCGA-qgjp-4ggj-3863CGA-qhgc-92pr-pw7pCGA-qhpj-p4f3-xf7mCGA-qjpq-hrvc-9hv7CGA-qmg2-v3qp-rx6rCGA-qr9f-8vmj-3f9gCGA-qvgj-cg4p-pfw5CGA-qw45-ccrg-w5vwCGA-qx2r-rwmq-c9wqCGA-r6jh-ppm2-x332CGA-r7jm-xf69-q6m9CGA-r9qr-f9hh-f8rvCGA-rc7c-f4qm-jj47CGA-rfmg-hh86-r69pCGA-rhg8-8846-rv25CGA-rhjw-g7v6-w288CGA-rq59-v7qc-qfxfCGA-rwgf-gg8q-x7x8CGA-v3hx-rwrg-xpc4CGA-v5mw-9849-7fjfCGA-vcc8-jrwr-45r7CGA-vf4f-qqgj-q77jCGA-vg9j-xcpq-9mhfCGA-vh49-73fx-rgfgCGA-vjfc-5phw-2fc4CGA-vjw2-r2hj-7h7mCGA-vpq3-cj27-w94gCGA-vrxx-684g-3538CGA-vxq3-w74r-6pr3CGA-w2xm-8xq2-69pgCGA-w4pq-x8mg-q83qCGA-w4rp-3w8m-x84rCGA-w5q3-484w-6whmCGA-w5q8-292w-v42gCGA-w6f6-c8xv-752rCGA-w7gg-g56c-v23qCGA-w7gh-9xgj-84gwCGA-w8mr-c6pf-w795CGA-w938-823f-jhrfCGA-w98c-9wg3-9787CGA-w9w6-vgc8-hx8jCGA-wcxj-ppjg-4j92CGA-wf4f-63w2-2mpwCGA-wfr2-xr25-jf5gCGA-wg7r-q39w-x3xfCGA-wh4p-5h97-2xmgCGA-wphx-64vq-hwwqCGA-wq5f-2c5v-777mCGA-wq8h-73qr-787xCGA-wq8v-xjh3-cg7mCGA-wqqm-qx53-4mpmCGA-wv73-h56x-727rCGA-wvfp-cfvv-wf8gCGA-x23m-c5g5-gw26CGA-x3h6-wgvh-vpc3CGA-x3jg-pggq-qwj7CGA-x88g-jf2q-mx5cCGA-xc8q-3f23-cccfCGA-xcpf-3q5p-4rvmCGA-xf38-j7fj-5qwmCGA-xhrj-h5jc-5pgfCGA-xjr9-55jx-6w3vCGA-xmp2-xx76-gj77CGA-xqm7-4ph2-jc33CGA-xrqc-2j95-39jwCGA-xvw8-r6fr-56ccCGA-xwx9-54vx-93gjCGA-xxjx-2xw2-fwv5
Advisory lineage Upstream: 0 Downstream: 9
Awaiting Analysis
Published: 15 Apr 2026, 09:05
Last modified:18 Sept 2026, 12:04
Vulnerability Summary
Overall Risk (default)
medium
36/100 CVSS Score
8.9 HIGH
v4.0 (cve.org)
EPSS Score
0.9% LOW
1% probability +0.21%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
15 Apr 2026, 09:05
Published
Vulnerability first disclosed
18 Sept 2026, 12:04
Last Modified
Vulnerability information updated
Description
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
CVSS Metrics
- v4.0•HIGH•Score: 8.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:P/AU:Y/U:Red
- v4.0•HIGH•Score: 8.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:Red
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Trends
Current EPSS score: 0.90%• Percentile: 58%
Techniques & Countermeasures
- CWE-385•Covert Timing Channel
Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
Affected Systems
- chainguard•apache-hop
< 2.17.0-r9
- chainguard•apache-nifi
< 2.9.0-r0 | < 2.9.0-r3
- chainguard•apache-pulsar-4.0
< 4.0.10-r0
- chainguard•apache-pulsar-4.1
< 4.1.3-r14
- chainguard•apache-pulsar-4.2
< 4.2.1-r0
- chainguard•camunda-zeebe-8.6
< 8.6.39-r3
- chainguard•commercial-elasticsearch-8.17
< 8.17.10-r2
- chainguard•commercial-elasticsearch-8.18
all
- chainguard•commercial-elasticsearch-8.19
< 8.19.15-r0
- chainguard•commercial-elasticsearch-9.0
all
- chainguard•commercial-elasticsearch-9.1
< 9.1.10-r0
- chainguard•commercial-elasticsearch-9.2
< 9.2.8-r1
- chainguard•commercial-elasticsearch-9.3
< 9.3.5-r0
- chainguard•druid
< 36.0.0-r15
- chainguard•elasticsearch-7
< 7.17.29-r12
- chainguard•elasticsearch-7-iamguarded
< 7.17.29-r12
- chainguard•elasticsearch-8.17
< 8.17.10-r21
- chainguard•elasticsearch-8.19
< 8.19.14-r2
- chainguard•elasticsearch-8.19-iamguarded
< 8.19.14-r2
- chainguard•elasticsearch-9.0
< 9.0.8-r10
- chainguard•elasticsearch-9.0-iamguarded
< 9.0.8-r10
- chainguard•elasticsearch-9.1
< 9.1.10-r4
- chainguard•elasticsearch-9.1-iamguarded
< 9.1.10-r4
- chainguard•elasticsearch-9.2
< 9.2.8-r2
- chainguard•elasticsearch-9.2-iamguarded
< 9.2.8-r2
- chainguard•elasticsearch-9.3
< 9.3.3-r2
- chainguard•elasticsearch-9.3-iamguarded
< 9.3.3-r2
- chainguard•geoserver-2.27
< 2.27.5-r5
- chainguard•geoserver-2.28
< 2.28.3-r3
- chainguard•ghidra
< 12.0.4-r2
- chainguard•gradle-8
< 8.14.4-r4
- chainguard•gradle-9
< 9.4.1-r2
- chainguard•hadoop-fips-3.4.2
< 3.4.2-r2
- chainguard•jenkins-2-openjdk-21
< 2.560-r0
- chainguard•jenkins-2-openjdk-25
< 2.560-r0
- chainguard•jenkins-2.528-openjdk-17
< 2.528.3-r4
- chainguard•jenkins-2.528-openjdk-21
< 2.528.3-r4
- chainguard•jenkins-2.541
all
- chainguard•jenkins-2.541-openjdk-17
all
- chainguard•jenkins-2.541-openjdk-21
all
- chainguard•jenkins-2.541-openjdk-25
all
- chainguard•jenkins-2.555
< 2.555.2-r3
- chainguard•jenkins-2.555-openjdk-21
< 2.555.2-r3
- chainguard•jenkins-2.555-openjdk-25
< 2.555.2-r3
- chainguard•jruby-10.1
< 10.1.0.0-r1
- chainguard•jruby-9.4
< 9.4.14.0-r5
- chainguard•kayenta-2025.0
all
- chainguard•kayenta-2025.1
all | < 2025.1.6-r9 | < 0
- chainguard•kayenta-2025.2
< 2025.2.4-r5
- chainguard•kayenta-2025.4
< 2025.4.3-r7
Showing first 50 affected entries in server-rendered view.
References (29)
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998
- https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87
- https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598
- https://nvd.nist.gov/vuln/detail/CVE-2026-5598
- https://github.com/bcgit/bc-java
- https://github.com/bcgit/bc-java/wiki/CVE-2026-5598
- https://access.redhat.com/security/cve/CVE-2026-5598
- https://bugzilla.redhat.com/show_bug.cgi?id=2458635
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5598.json
- https://access.redhat.com/errata/RHSA-2026:12267
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:12269
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/security/updates/classification/#important
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index
- https://access.redhat.com/articles/7137599
- https://issues.redhat.com/browse/JBEAP-32774
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12267.json
- https://www.cve.org/CVERecord?id=CVE-2026-5598
- https://security-tracker.debian.org/tracker/CVE-2026-5598
- https://www.bouncycastle.org/download/bouncy-castle-java/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5598.json
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646