CVE-2026-5598

What it actually does

The vulnerability is a covert timing channel in the BC-JAVA core implementation associated with FrodoEngine.java, used for Frodo post-quantum cryptographic operations. When vulnerable versions perform affected operations, observable timing differences may depend on secret internal values. An attacker able to trigger or observe enough cryptographic operations may infer sensitive key material or session secrets, undermining confidentiality and potentially enabling impersonation or tampering in systems that rely on the affected Frodo implementation.

Why it matters to the business

Applications that use vulnerable BC-JAVA versions for affected Frodo cryptographic operations may not provide the expected protection for sensitive data or authentication flows. Successful exploitation could expose encrypted communications or allow trust decisions based on compromised cryptographic material. The current public exploitation signal is low: EPSS is 0.00691, there is no known CISA KEV listing, no ransomware association, and exploit maturity is reported as none; however, cryptographic weaknesses can have high impact where the affected algorithm is used in security-critical services.

How an attack unfolds

An attacker first identifies an application or service that uses a vulnerable BC-JAVA release and exercises the affected FrodoEngine code path. The attacker then repeatedly triggers cryptographic operations, such as key encapsulation, decapsulation, or related protocol actions, while measuring response timing or another externally observable timing signal. By collecting many measurements and filtering noise, the attacker attempts to correlate timing differences with secret-dependent execution behavior. If enough signal is recovered, the attacker may derive sensitive cryptographic information and use it to decrypt protected data, impersonate a trusted party, or compromise protocol integrity depending on how the affected library is used.

How to fix it

Upgrade BC-JAVA to a fixed version. Affected ranges are BC-JAVA 1.71 before 1.80.2, 1.81 before 1.81.1, and 1.82 before 1.84. Use the newest compatible fixed release, preferably 1.84 or later, or the appropriate fixed maintenance release such as 1.80.2 or 1.81.1 where a specific line must be retained. Update all direct and transitive Bouncy Castle dependencies, including bcprov, bcpkix, bcmail, and related core modules if present. If immediate upgrade is not possible, avoid using the affected Frodo functionality, restrict exposure of services that trigger it, reduce attacker ability to perform high-volume repeated timing measurements, and add rate limiting; these mitigations reduce exploitability but do not remove the cryptographic weakness.

How to confirm the fix worked

Confirm dependency resolution shows only fixed BC-JAVA versions: 1.80.2 or later on the 1.80 line, 1.81.1 or later on the 1.81 line, or 1.84 or later for the 1.82+ line. Inspect build outputs, container images, shaded JARs, application servers, and dependency lockfiles for older Bouncy Castle artifacts. Use tools such as Maven dependency:tree, Gradle dependencies, SBOM scanners, SCA tools, and runtime classpath inspection to verify no vulnerable bcprov/bcpkix/bcmail/core module remains. Validate that applications start with the expected upgraded library and that cryptographic integration tests still pass. For high-assurance systems using Frodo, consider side-channel-oriented regression testing or vendor-provided test guidance to confirm the patched implementation is in use.

Typical attack path

1. Identify a remotely reachable application, API, or service using BC-JAVA core versions 1.71 through vulnerable 1.80.x, 1.81, or 1.82 through vulnerable 1.83.x.
2. Confirm that the application uses Frodo-related post-quantum cryptographic functionality from BC-JAVA.
3. Send repeated protocol requests or cryptographic inputs that cause the vulnerable FrodoEngine code path to execute.
4. Measure response timing at high volume and account for network jitter, retries, and application-layer noise.
5. Analyze timing distributions to recover secret-dependent information.
6. Use recovered cryptographic material or derived secrets to decrypt data, impersonate peers, or compromise security controls that rely on the affected cryptographic operation.

How to detect it

There are no reliable exploit-specific log entries, process names, network signatures, or file artifacts that prove this timing-channel issue was exploited. Investigation should focus on exposure and anomalous usage patterns. Review dependency inventories, SBOMs, build logs, application packages, and runtime classpaths for vulnerable Bouncy Castle versions and for use of FrodoEngine or Frodo cryptographic APIs. For possible exploitation, examine application, API gateway, load balancer, and network telemetry for unusually high volumes of repeated cryptographic handshake, encapsulation, decapsulation, or authentication requests from the same source or distributed sources over time. Look for precise, repetitive request patterns with low payload variation, high retry counts, or measurement-like behavior. In systems where Frodo operations protect sessions or keys, investigate suspicious authentication successes, unexpected key negotiation failures, unexplained decryption events, or integrity failures around periods of high-volume probing. Absence of these signals does not rule out exploitation because timing side-channel attacks can resemble normal protocol traffic.

What your security team should do

• Inventory all applications, services, containers, and vendor packages that include BC-JAVA or Bouncy Castle artifacts.
• Prioritize remediation for internet-facing services, authentication systems, key-management components, encrypted messaging workflows, and systems known to use Frodo post-quantum cryptography.
• Upgrade vulnerable BC-JAVA versions to 1.84 or later where possible, or to the fixed maintenance versions 1.80.2 or 1.81.1 where required.
• Check for shaded, repackaged, or bundled Bouncy Castle classes because standard dependency scans may miss embedded copies.
• If upgrade cannot be completed immediately, disable affected Frodo functionality where feasible and apply compensating controls such as access restrictions and rate limiting.
• Monitor vendor advisories and package repositories for any updated exploitation guidance, proof-of-concept activity, or additional fixed releases.
• Because the issue is not currently listed in KEV and has low EPSS, schedule remediation based on cryptographic usage and data sensitivity rather than treating all deployments as equally exposed.