This security advisory for Red Hat JBoss Enterprise Application Platform 7.4.24 addresses CVE-2026-5598, a vulnerability in the bouncycastle Java library where private keys may leak due to non-constant time comparisons. The issue is mitigated by upgrading bouncycastle from version 1.78.1 to 1.84 or later. The advisory is classified as important by Red Hat and is part of an asynchronous patch for the platform. No detailed CVSS score is provided in the advisory, but the severity is considered high based on the potential private key leakage. The update requires prior errata to be applied and recommends backing up existing installations before applying the patch.

The vulnerability allows private key leakage through timing side-channel attacks caused by non-constant time comparisons in the bouncycastle library. This could compromise cryptographic keys used by applications running on Red Hat JBoss Enterprise Application Platform 7.4, potentially undermining the confidentiality and integrity of secure communications or data protected by these keys.

A security update is available that upgrades the bouncycastle library from version 1.78.1 to 1.84 or later, which addresses the private key leakage vulnerability. Users should apply this update after ensuring all previously released errata relevant to their system have been installed. It is recommended to back up all applications, configuration files, databases, and settings before applying the update. Follow the official Red Hat guidance for applying the patch as detailed in the advisory. No alternative mitigations or workarounds are indicated.