This vulnerability (CVE-2026-5598) in BC-JAVA involves a covert timing channel caused by non-constant time comparisons in cryptographic operations, leading to potential private key leakage. It affects multiple versions of BC-JAVA core modules, including FrodoEngine.Java. The CVSS 4.0 score is 8.9 (high severity), indicating network attack vector, low attack complexity, no privileges or user interaction required, but high impact on confidentiality, integrity, and system availability. Red Hat's advisories confirm the issue and provide patches by upgrading Bouncy Castle to version 1.84 in their JBoss Enterprise Application Platform 7.4 distributions for RHEL 7, 8, and 9. No known exploits in the wild have been reported. The vendor remediation level is not explicitly stated but patches are available via Red Hat errata.

The vulnerability can lead to private key leakage through timing side-channel attacks, compromising the confidentiality of cryptographic keys. This can undermine the security of applications relying on BC-JAVA for cryptographic functions. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability if exploited.

Red Hat has released security updates for JBoss Enterprise Application Platform 7.4 that upgrade Bouncy Castle from vulnerable versions to 1.84 or later, which fixes this vulnerability. Users should apply these official patches as provided in the Red Hat advisories (RHSA-2026:12267 and related errata). Prior to updating, ensure all previous errata are applied and back up existing installations. Patch status is confirmed by Red Hat advisories. No additional mitigation steps are indicated beyond applying the official updates.