CVE-2026-5598: Bouncy Castle Covert Timing Channel Vulnerability in BC-JAVA Packages
Summary
CVE-2026-5598: Bouncy Castle Has Covert Timing Channel Vulnerability. Affects org.bouncycastle:bcprov-jdk15to18 versions >= 1.71, < 1.84. Fixed in 1.84. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bouncy Castle is a widely used cryptography library that provides a range of cryptographic functions and algorithms for Java applications. The library is known for its flexibility and extensive support for various cryptographic protocols. However, certain versions of the Bouncy Castle library, specifically BC-JAVA, have been found to contain a covert timing channel vulnerability, which could potentially allow attackers to infer sensitive information based on timing discrepancies in cryptographic operations.
Vulnerability Detail
The covert timing channel vulnerability in the Bouncy Castle library arises from the way certain cryptographic operations are executed. This vulnerability allows an attacker to exploit timing variations to gain insights into the data being processed, potentially leading to unauthorized access to sensitive information. The issue affects versions of the library from 1.71 up to, but not including, 1.84. The vulnerability is classified under CWE-385, indicating that it can lead to information leakage through timing analysis.
How To Fix
Minimum fixed version
1.84
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing additional security measures to mitigate the risk of timing attacks. This may include introducing random delays in cryptographic operations or using constant-time algorithms where applicable. However, these workarounds may not fully eliminate the risk associated with the vulnerability.
Conclusion
The Bouncy Castle covert timing channel vulnerability (CVE-2026-5598) poses a significant risk to applications using affected versions of the library. It is crucial to update to the patched version (1.84 or later) to safeguard against potential data leakage. Utilizing tools like Vulert can assist in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for org.bouncycastle:bcprov-jdk15to18 →
FAQ
A covert timing channel vulnerability allows an attacker to infer sensitive information based on the time it takes for a system to respond to certain inputs, potentially leading to data leakage.
The vulnerability affects Bouncy Castle versions from 1.71 up to, but not including, 1.84.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply analyzing your pom.xml file, Vulert can help you identify if your application is affected.
The CVSS score of this vulnerability is 8.9, indicating a high severity level.
If you cannot update the library right away, consider implementing workarounds such as adding random delays to cryptographic operations or using constant-time algorithms to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.bouncycastle:bcprov-jdk15to18.
