Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).
This vulnerability is associated with program files FrodoEngine.Java.
This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
{
"cna_assigner": "bcorg",
"cwe_ids": [
"CWE-385"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5598.json",
"unresolved_ranges": [
{
"source": "AFFECTED_FIELD",
"extracted_events": [
{
"introduced": "1.71"
},
{
"fixed": "1.80.2"
},
{
"introduced": "1.81"
},
{
"fixed": "1.81.1"
}
]
}
]
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5598.json"
"2026-08-07T17:31:48Z"
[
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-04150061",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "matrix_add"
},
"deprecated": false,
"digest": {
"length": 353.0,
"function_hash": "283691487368964357002640377984878064476"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87",
"id": "CVE-2026-5598-0c329227",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "sample_matrix"
},
"deprecated": false,
"digest": {
"length": 303.0,
"function_hash": "163973598588319161711360540188991627769"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-12e78d9e",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "kem_keypair"
},
"deprecated": false,
"digest": {
"length": 1833.0,
"function_hash": "231760130691454244623438463541817262200"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-1ea2e036",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "unpack"
},
"deprecated": false,
"digest": {
"length": 857.0,
"function_hash": "165982031433831004434769739153808386758"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-3e074516",
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"120537562123318964947099403340279064396",
"300574455515379228679488193410000065503",
"83615518386651486378063113507710442388",
"272618783909033177939059839662067455392",
"51986115525157120930501813668530728760",
"45220394379206341868575293054241713500",
"327873788059423290631111788954582513724",
"173827667962523940196833276341435970939",
"278553016402533507272248491859812104279",
"272360737491692536350011752943964174373",
"213371583603114881127663443849958056355",
"167080687819361241397448544732756428566",
"247928115508678001162181231721548396536",
"198207024891057209271674754248116496551",
"177722057013023027634464324523630856369",
"200589913734316282617717608585177787722",
"218756321457577310619902755330064238610",
"228314632614195251319765108320658007806",
"36774520843449809785422937498274625846",
"275042004580745306286378749095844101746",
"180643526628063838486983020297646171595",
"222515607134821027936491077177332488025",
"160894135103846925138353522332672056998",
"294807664581285285849009793621874432683",
"283871861606604874912648613501868179210",
"258240484059079425171147308412880700379",
"93561756741339255582372433113344648976",
"66165000239946077444058362528809537636",
"201865093634862037980638694558130882639",
"24158986212090490332006769434468232441",
"309774537846078753756071102256692060843",
"205836919947286539326225167145173562961",
"205603138659997528791802587576927934499",
"272256875647643352409638309702144853663",
"260937889087329675390402286625839800816",
"289799082464083381548644032808591489277",
"165881148472254497696318701703620299594",
"293721910111505839119579834712145075768",
"112874619529561748543753146586062701152",
"70684753284947416187466514162801333100",
"21660409673702344014894007056371048738",
"301610097998262470891609465723116817655",
"75407180318704451699303769443305508093",
"134308372633093423839778360263184651575",
"218635310475412158388630683938551698725",
"144421860780084220481278310901347928775",
"307406722556801747544980497062829276417",
"303412845221994066774483883252721197362",
"227828971997441395266166394226586571011",
"281517637647073182903761948772342045550",
"288225115032489143644123481943322198674",
"90963081472031635532634296327441440984",
"310476016151967471395535305013165756063",
"327441287571378152571592100758158078014",
"36743835874905430695381558970149962486",
"100553629945665316634490064407732647120",
"14554809059102484759639684096609161233",
"149104471863899267039060690356747112200",
"183450755543982546580475737778086896733",
"39031545736602366684491761719069425380",
"248407165088636562880749741850873679882",
"230615942526322952595812104730352004994",
"112071726244492387422494221460193913456",
"338110129055812531117127669614502516079",
"14151447150284352829318708990515363586",
"202707606067673275964073346879735507052",
"187967517037043636272886309072777714311",
"287008004124970298631318711388475161732",
"144511906151676283447582081720352405140",
"328813877699297856580751912218325436648",
"124117267109777991137394481890381605959",
"270609126708263018592881940648297272450",
"277030181381295660398386750740492651075",
"265612679622380097294028893545805056342",
"234199691097564711947763339726194632427",
"124282053610067216392324622417209054376",
"338391673659647402329471578232567483232",
"189950666340456849324124482470617339028",
"294116305292473056641669135470090140756",
"43161444131701709584107101145463019982",
"38753267609352086764119928563399987856",
"197767877850849192247308307453651643445",
"95551334736538425703794955580664583262",
"117282520717865441816949584114587826363",
"286135730224338017372937888634971006289",
"137919134331375982994723809148036674601",
"39013911878827665060482240991607721209",
"219871180997608291597605630934850842182",
"236702332753729299514606387935343985560",
"46338681896759851596878683452651622088",
"193338045781040238500868147660084701643",
"218061432192498485947822415411942516158",
"112874619529561748543753146586062701152",
"70684753284947416187466514162801333100",
"21660409673702344014894007056371048738",
"301610097998262470891609465723116817655",
"75407180318704451699303769443305508093",
"169889788574790864439253433268352566293",
"15736956120267810389881192568858677461",
"152700241390525047713161491400298433068",
"335740897719493943224127327341267098544",
"303412845221994066774483883252721197362",
"40464233353424410597490867012492985956",
"243279354067047611367129345875753017931",
"88805487782134419518364155828424577720",
"57897789871807806732479221361572771280",
"61534362200981985529550922477306360071",
"258626374048686683106571345339591397653",
"96221634952662855858006815607691012986",
"1312957939284668312395125718622020263",
"168430375300102208382193737893911463559",
"148311975756727917051782963814735859578",
"328297074780560842095783134534212364235",
"132846196102312864372307125307235058543",
"73934004629550253549971010291198769750",
"57638798938607233202592140224844041841",
"154155341647275587577452276484599123395",
"219419068032385839199306466641885072335",
"238886780002012671540603197257635471231",
"76778140877139235046051479830376087857",
"37843645943486128120979417038820910565",
"259622118749718076713718411347256911278",
"189272389067243070647875062928175734761",
"212631654832868305021340189211326746709",
"59477211767411402517475905991265802764",
"60736408601639829875049247146819716195",
"316085129103845015486359891941354533953",
"57411240661504353479576550203590971940",
"327281798414152901757456053759455998010",
"109979993605722453329565363356335489985",
"300995375200269352758395608384566955589",
"146453022457508876012053992610600173429",
"117084395193969463605111636097873556504",
"295064012448893853391914903598856066005",
"149061887361931577243687052636875022398",
"159412829286263037331780401195872535910",
"74402181019276555804251715186978805058",
"266497328658507703181203329199227111020",
"297437970895710562133873419944877765796",
"161569855569240648631241531678492530911",
"337233322472398754566128276489947284186",
"159670194553379032684520482230077096872",
"313248631080512276882949832417749602724",
"10634236475225157517719211060985016217",
"272318714047544685718952009571015993109",
"191379501243062828798505313506508611234",
"150583197364015531286649559454726939741",
"230340342289014357018374295634188926655",
"179895970064321706128792503124192478107",
"240081927435997008806038303541293289918",
"96180183163662010905856996577492044920",
"40195950145397079624252792745826367833",
"302977188236032644655455822392901638972",
"3898050479481557536181768136050466045",
"335027838367880518005847229797507534698",
"264080064812877771508939513761719736874",
"294530749898732846264924704298728741023",
"33854891246508812696462853032179333905",
"19951898780160016858853512481960896097",
"57704545215869854465335926930789920300",
"133685389729077072416694842850975910625",
"143129530613169902133799447833111015017",
"127897223490542681897930710039984714187",
"339786183989367404147125623232852897610",
"12249823138964863182319069846341042483",
"287001087289052264939189067123266409234",
"83485333671213066286869422577785991881",
"244335232765372353874943952239231086743",
"245672079570315935568726034925933450372",
"116740435018501223942800548512234219543",
"314967943679414745985823668747249518141",
"309462343747083802122364336389352110116",
"98001677133646112344044134226729454184",
"18274971401742937793538762690501387263",
"293485198401565891812728086447264288893",
"315764576629707699163109201083610343640",
"26645781676530078647292941129650023669",
"175230829956185036153680197128239458544",
"6167316786459578267955013894104467226",
"1449723880632403073830097872852577309",
"113625298699486016659712345839431557456",
"203959516040577727450811359654435591642",
"43585746058145899753046514166734766099",
"169086308429928372859860816365047907962",
"59343713634732748402049542627632725184",
"149635747574796723439426330707229922601",
"43893933572696669237785089731487112217",
"59196241686654213676052223103797365715",
"203668842823855645846085789581433501474",
"332505436499497384509131680239937483750",
"252267064251138460660414073393764688223",
"205342814701864477057737766531780881315",
"78307981887479557320644444834857969160",
"249959866007057265072812913644874615416",
"133655344749918862501251701994201954501",
"296826233240299197332132596262034028207",
"44529552765466431822843789700602840786",
"26255923966558637911986669551429069840",
"263309983939047355824486101464835090905",
"204523368759150603083902636705040588801",
"161339114473739849452966145353641708559",
"278921825340651516760657150597093088730",
"185595760570288348060313848325272236500",
"18773947188309851293217274164130692612",
"141845023958137233812863008334858278940",
"69272438880055732474469204316707815349",
"321495530470622026247626848429837350518",
"209746007266885402959945267887422312718",
"312620536096889082045360529331272451705",
"285258034398881904529928803053506008385",
"289430438134862581505765403894369946468",
"235834120408608706749857687676020657270",
"49955607972964118012347114969159396195",
"338165870717327787667607243661204236545",
"177935024376376264864180984644388356449",
"183587382902072002336911974956553488056",
"34540785444279003401177440160748763671",
"240263895279568967537814254965886563877",
"146243080404867824540361739086465370166",
"324763793606492426652984378892776187624",
"233380686964255235204258205132360265994",
"258042552737881398213855359242103348064",
"199049697877305468568478729017853651119",
"304399724934517949149215521967692743488",
"14587818458497957530164385827265893548",
"203891646053064559296568554980539534086",
"179473046826762068209613295956340821268",
"35831994394159646745260166854486185034",
"286876507609913019257942642007342796649",
"246427413027173617082671863287559854214",
"175406089490101864247004145173574769720",
"238290785049773472088136263965668149260",
"125946916849189493370160631902956398347",
"28427076860691928923260251371231682322",
"44464891356967140999835696581317594126",
"127751280728908763683009544626923051751",
"46228237845811794300741331564482648070"
]
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-407b12dd",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "pack"
},
"deprecated": false,
"digest": {
"length": 697.0,
"function_hash": "127038623232416174335785728950235969210"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-47a81b06",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoMatrixGenerator.java",
"function": "genMatrix"
},
"deprecated": false,
"digest": {
"length": 591.0,
"function_hash": "159745705055286248628015620230754621298"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-5253651e",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "encode"
},
"deprecated": false,
"digest": {
"length": 445.0,
"function_hash": "272224695971436771800323982378445183684"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-8ffbdd3f",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "decode"
},
"deprecated": false,
"digest": {
"length": 617.0,
"function_hash": "27310308696661833546327717111510881956"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87",
"id": "CVE-2026-5598-93f1c482",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "sample"
},
"deprecated": false,
"digest": {
"length": 306.0,
"function_hash": "200967775042998598947451712049362369869"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-9612c3bf",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "ctverify"
},
"deprecated": false,
"digest": {
"length": 318.0,
"function_hash": "91425813711454056819201338176136379397"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-ac45b0c3",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "kem_enc"
},
"deprecated": false,
"digest": {
"length": 1977.0,
"function_hash": "278809567339530972544033981524849818372"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-c646eae6",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "ctselect"
},
"deprecated": false,
"digest": {
"length": 280.0,
"function_hash": "244124971467744193808778775933815308443"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-c8f9f70d",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "kem_dec"
},
"deprecated": false,
"digest": {
"length": 2650.0,
"function_hash": "330273637735467230101275505849969368486"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-cbdce6ac",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "matrix_sub"
},
"deprecated": false,
"digest": {
"length": 353.0,
"function_hash": "72241559351007690044719995863758287333"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87",
"id": "CVE-2026-5598-d4c543cc",
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"44075979019983172381968011422339639413",
"283742363016946136642768130638961571513",
"161044780520136252796361088435991478945",
"69174166713242517247949348579061470937",
"237280498547926980941798151879453754751",
"62664362592712521971995540375505266597",
"34675048271954231940670540548496151764",
"90067095365670808363648185509124976633",
"86517434022290054981040862987267196042",
"113520614895262467310029340318143064696",
"37840482392931420553304233404273156187",
"177755392864874909284658614131317029121",
"192998479702424690124593073204189987292",
"7383622663368356398033951777962083826",
"7117791792312551219535721697631986877",
"336696824539523245748532211192526741548",
"251513619240269551686138476903015633906",
"90734980105108641312314776570203010901",
"151211410662691437154795495454821270240",
"72261861087767496622549659998296671511",
"243818485438916857221670907340018824047",
"101912332338862190315587018745575363409",
"145074416672636268708036465811059262191"
]
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-e51008a0",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoMatrixGenerator.java",
"function": "genMatrix"
},
"deprecated": false,
"digest": {
"length": 32.0,
"function_hash": "190245899412705784213351568421130417899"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-e6e8c214",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "matrix_transpose"
},
"deprecated": false,
"digest": {
"length": 268.0,
"function_hash": "223542289844891200410688575964029177253"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-f22d91e3",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoEngine.java",
"function": "matrix_mul"
},
"deprecated": false,
"digest": {
"length": 463.0,
"function_hash": "198542309121813814714234613983288723145"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-f3ccf2ff",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoMatrixGenerator.java",
"function": "genMatrix"
},
"deprecated": false,
"digest": {
"length": 579.0,
"function_hash": "127032161112728274896292203012844791397"
}
},
{
"source": "https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5",
"id": "CVE-2026-5598-f9f20a55",
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoMatrixGenerator.java"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"221597074493886695467924030080232859574",
"14848519377622312263613203949877004126",
"248930699436226149823354017638581757630",
"279963216682635227870097334100647801061",
"40252020929961834665921774520681159769",
"208612736129189935754252307494638468308",
"181240403978254450914631049084464769823",
"31324629212023805211342931578783601229",
"325657888193070381649145493547545009456",
"289773562150754185081276473000664595744",
"101993169145803693345116748215167636621",
"261958960580829304468383155728659949332",
"54606102223621488197778923545771858021",
"287459384317467629841819809202587454603",
"254220479705980671961501076182961231656",
"150198866673237701601716810618527613429",
"48478084502342354529935356416249753939",
"16911460372403137823651787635675116369",
"267470074618381582573185234705298103390",
"207115162820826167365733717876484459582",
"300895274208847000529244991543038780044",
"75355532044219965312828008317653476016",
"232135671303458596311729157659046139116",
"241249547149294607778656404114152737894",
"52584923828131527534712112345559109823",
"331353217217523550115362304734193924089",
"100771343872963081622267360734963471347",
"38367693306531583642406067019265639577",
"102915726015172412996935110394004375536",
"170460876588802289846963518200007315891",
"68525799146659929395840407156213513443",
"96965782551601567511286357917430969824",
"300451311433301028911468811857742063648",
"32391300326625889188797295563407354788",
"87573449208130644642243091832690782444",
"178964807328585247959720715480153164240",
"3962354860363072203414672466684443895",
"121630642233694046568673085339755098758",
"304045094640533995975951482195172011634",
"221748171025787691347371050260377682146",
"60298672217816375843102409078787555891",
"188358189534497995604280309025343877439",
"80571247344680075767108229707467647386",
"150198866673237701601716810618527613429",
"48478084502342354529935356416249753939",
"16911460372403137823651787635675116369",
"60798732908226433100248552064539743949",
"251642872997417931289231663692167168554",
"103477153247239623137499678725985589756",
"298887925998845899204540643449784615428",
"324900351759986805545177580920914759698",
"156266221463433218920194454603383200342",
"254963531162232882988819282372376519343",
"256392997785299782210250035087243232422",
"4770665562539188085669996243049889351",
"192657833193495279511040204460754233651",
"200311778324439608086732029258105937831",
"19249065674072142109465484246480506535",
"230414197113301689833027382824896432878",
"16416251724238211224998589134409017975",
"38503300723171477500523457264738650591",
"222620841794736441138952853023177045643",
"318472599981297088183679409819868005822"
]
}
}
]