CVE-2026-5598: 
Java vulnerability analysis and mitigation

CVE-2026-5598 is a covert timing channel vulnerability in the Legion of the Bouncy Castle BC-JAVA cryptographic library, specifically within the FrodoKEM implementation (FrodoEngine.java). Non-constant time comparisons in the error sampling and ctverify() functions risk private key leakage during FrodoKEM decapsulation operations. The vulnerability affects BC-JAVA versions 1.71 through 1.80.1, 1.81, and 1.82 through 1.83, across Maven packages bcprov-jdk14, bcprov-jdk15to18, and bcprov-jdk18on. It was published on April 15, 2026, and carries a CVSS v4.0 base score of 8.9 (High) (GitHub Advisory, BC-JAVA Wiki).

The root cause is classified as CWE-385 (Covert Timing Channel). The original sample() function in FrodoEngine.java used a non-constant-time comparison (if (t > T_chi[z])) when sampling from the noise distribution during FrodoKEM decapsulation, and the ctverify() function similarly performed variable-time operations. An attacker positioned to observe timing differences in decryption responses — for example, via a network-based side-channel — can accumulate timing measurements across many decapsulation queries to statistically recover the private key. No authentication or user interaction is required, and attack complexity is rated Low. The fix, introduced in commits 94abbd5 and 8692e6b, replaced the variable-time sample() with a constant-time implementation using bitwise arithmetic ((cdf[j] - prnd) >>> 31) and refactored ctverify() accordingly (GitHub Commit 94abbd5, GitHub Advisory).

Successful exploitation allows a network-based attacker to recover FrodoKEM private keys by observing timing differences across multiple decapsulation operations, without requiring authentication or user interaction. This leads to a complete compromise of confidentiality and integrity for any cryptographic material protected by the affected FrodoKEM keys, including session keys and encrypted communications. The vulnerability only affects users of the FrodoKEM algorithm involved in decryption of encapsulations; availability is not directly impacted. Downstream IBM products including MQ Container Software, Instana Observability, App Connect for Manufacturing, Business Automation Manager Open Editions, and Maximo Application Suite are also affected as they bundle vulnerable BC-JAVA versions (BC-JAVA Wiki, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.022% (6th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS v4.0 exploit maturity is rated "Unreported," though the attack is theoretically automatable and requires no privileges, making it a candidate for future weaponization by sophisticated threat actors with cryptanalytic capabilities.

1. Identify target: Locate services or applications using BC-JAVA versions 1.71–1.83 that perform FrodoKEM decapsulation operations, such as TLS endpoints or key exchange services built on affected Bouncy Castle libraries.
2. Establish network access: Gain a network position with low-latency, high-precision timing measurement capability relative to the target service (e.g., co-located in the same data center or on the same network segment to minimize jitter).
3. Submit crafted encapsulations: Send a large number of crafted FrodoKEM encapsulation ciphertexts to the target's decapsulation oracle, varying inputs to probe different code paths in the non-constant-time sample() function.
4. Collect timing measurements: Record precise response times for each decapsulation query, accumulating thousands to millions of measurements to build a statistical profile of timing differences correlated with secret key bits.
5. Perform statistical analysis: Apply timing side-channel analysis techniques (e.g., based on the methodology described in section 10.3.1 of the FrodoKEM standard proposal) to correlate timing variations with the CDF table comparisons and recover the private key material.
6. Recover private key: Use the recovered key to decrypt previously captured ciphertexts or impersonate the target in future cryptographic operations (BC-JAVA Wiki, GitHub Advisory).

• Network: Unusually high volume of repeated decapsulation/key-exchange requests from a single source IP or a small set of IPs targeting FrodoKEM-enabled endpoints; requests with statistically similar but slightly varied ciphertext inputs.
• Logs: Application or service logs showing an abnormally large number of FrodoKEM decryption/decapsulation operations in a short time window, potentially from automated clients; timing anomalies in cryptographic operation logs if instrumented.
• Process/Application: Unexpected spikes in CPU usage associated with the Java process running BC-JAVA during periods of high decapsulation request volume.

Note: Timing side-channel attacks are inherently difficult to detect via standard IOCs, as they exploit statistical properties of legitimate operations rather than injecting malicious payloads. Detection relies primarily on anomaly-based monitoring of request patterns.

Upgrade BC-JAVA to one of the fixed versions: 1.80.2, 1.81.1, or 1.84 (for Maven packages bcprov-jdk14, bcprov-jdk15to18, and bcprov-jdk18on). There are no known configuration-based workarounds; the only effective remediation is upgrading to a patched version. Organizations using affected IBM products (MQ Container Software, Instana Observability, App Connect for Manufacturing, Business Automation Manager Open Editions, Maximo Application Suite) should apply the respective IBM security bulletins. Prioritize patching any systems that expose FrodoKEM decapsulation operations over a network (BC-JAVA Wiki, GitHub Advisory, IBM MQ Bulletin).

The Bouncy Castle maintainers (Legion of the Bouncy Castle Inc.) published a detailed wiki advisory crediting the discovery to section 10.3.1 of the latest FrodoKEM standard proposal, which highlighted timing attack concerns relevant to the BC-JAVA implementation (BC-JAVA Wiki). IBM issued multiple security bulletins addressing the vulnerability across its product portfolio, including Instana, MQ, App Connect for Manufacturing, Business Automation Manager, and Maximo Application Suite. The Keycloak project released version 26.6.2 to address this and related vulnerabilities, and the SUSE and Red Hat Linux distributions issued security advisories for their packaged versions of Bouncy Castle.