CVE-2026-5598

OVERVIEW CVE-2026-5598 is a covert timing channel vulnerability discovered in Legion of the Bouncy Castle Inc.'s BC-JAVA cryptographic library, specifically within the FrodoEngine.Java component of the core modules. The vulnerability affects BC-JAVA versions 1.71 through 1.83, impacting all users of these versions. SEVERITY The CVSS score is not yet assigned; however, the FAUCET Risk Score of 52.0/100 indicates moderate severity. As a timing channel vulnerability, this issue could potentially allow attackers to extract sensitive cryptographic information through side-channel analysis by measuring execution time variations. The attack would require access to measure precise timing differences during cryptographic operations, suggesting moderate attack complexity. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog, and no public exploit code is currently available. Community attention remains minimal, as indicated by the inactive status on security tracking lists and an extremely low EPSS score of 0.00018, suggesting this is not a prioritized threat in real-world attack scenarios.