CVE-2026-5598

HighCVSS 7.5/10Last modified Sep 18, 2026

Description

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).

This vulnerability is associated with program files FrodoEngine.Java.

This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-385

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Apr 15, 2026
Last modified
Sep 18, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-559805.5A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-serCVE-2026-559819.6A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and uplCVE-2026-559829.1OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token ScopesCVE-2026-559842.7Null Pointer Dereference in AddTime API Causes Authenticated Denial of ServiceCVE-2026-559854.3The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuraCVE-2026-559865.4Email Management API Bypasses ManageCredentials Feature RestrictionsCVE-2026-559878.1OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)CVE-2026-55997.3A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.CVE-2026-559905.9In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there arCVE-2026-559915.9In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled withCVE-2026-559937.5Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in ACVE-2026-559947.5Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in A
CVE-2026-5598: High severity, CVSS 7.5 | Vulnix