This vulnerability (CVE-2026-5598) in BC-JAVA involves a covert timing channel due to non-constant time comparisons in the FrodoKEM implementation. Such timing discrepancies can potentially allow attackers to infer private key material by measuring operation durations. The affected versions include BC-JAVA starting from 2.17.3 up to but not including 1.84. The CVSS 4.0 base score is 10.0, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No patch or official remediation level has been provided by the vendor as of the published date.

The vulnerability can lead to private key leakage through timing side-channel attacks, compromising the confidentiality of cryptographic keys used in FrodoKEM within BC-JAVA. This could undermine the security guarantees of cryptographic operations relying on this library, potentially allowing attackers to recover sensitive key material remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor the vendor's communications for updates. Until a patch is available, consider avoiding use of the affected BC-JAVA versions in sensitive environments or applying any recommended workarounds from the vendor if they become available.