← CVE Intelligence

CVE-2026-5598

Non-constant time comparisons risk private key leakage in FrodoKEM. PUBLISHED

Description (CNA)

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Affected (CNA)

Vendor / productVersions
Legion of the Bouncy Castle Inc. / BC-JAVAaffected 1.71 before 1.80.2; affected 1.81 before 1.81.1; affected 1.82 before 1.84

CWE

CWE-385

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy to gain unauthorized access to sensitive cryptographic information.