Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.84.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1639-1 advisory.

    Update to version 1.84.

    Security issues fixed:

    - CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).
    - CVE-2026-0636: LDAP injection in LDAPStoreHelper.java leads to information disclosure (bsc#1262226).
    - CVE-2026-3505: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).
    - CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).
    - CVE-2026-5598: non-constant time comparisons risks private key leakage in FrodoKEM (bsc#1262227).

    Other updates and bugfixes:

    - Version 1.84:
      - In line with JVM changes, KEM support has been backported to         Java 17.
      - BCJSSE: Configurable (client) early key_share groups via         BCSSLParameters.earlyKeyShares or         'org.bouncycastle.jsse.client.earlyKeyShares' system property.
      - BCJSSE: Support for curveSM2MLKEM768 hybrid NamedGroup in TLS         1.3 per draft-yang-tls-hybrid-sm2-mlkem-03.
      - BCJSSE: Log when default cipher suites are disabled.
      - BCJSSE: Experimental support for ShangMi crypto in TLS 1.3 per         RFC 8998 (not enabled by default).
      - CMS: Added CMSAuthEnvelopedDataStreamGenerator.open taking an         explicit content type.
      - HKDF: Provider support for HKDFParameterSpec.Expand.
      - Added initial support for RFC 9380 (Hashing to Elliptic Curves);
        see org.bouncycastle.crypto.hash2curve .
      - PKCS12: Added default max iteration count of 5,000,000 (configurable         via 'org.bouncycastle.pkcs12.max_it_count' property).
      - TLS: Use javax.crypto.KEM API (when available) to access ML-KEM         implementation (incl. hybrids).
      - A new KeyStore, PKCS12-PBMAC1, has been added which defaults to         using PBMAC1 and supports RFC 9879.
      - A new property 'org.bouncycastle.asn1.max_cons_depth' has been added         to allow setting of the maximum nesting for SETs/SEQUENCESs in ASN.1.
        Default is 32.
      - A new property 'org.bouncycastle.asn1.max_limit' has been added         to allow setting of the stream size of ASN.1 encodings. The value can         be either in bytes, or appended with k (1 kilobyte blocks), m (1         megabyte blocks), or g (1 gigabyte blocks).
      - Added NTRU+ support to the lightweight PQC API and the BCPQC provider.
      - Added SM4 key wrap/unwrap mode, SM2 key exchange, and logging to SM2Signer.
      - OpenPGP: Added encryption-key filtering by purpose, a new OpenPGPKey         constructor, KeyPassphraseProvider-based passphrase change, wildcard         (anonymous) recipient handling, and Web-of-Trust methods for         third-party signature chains and delegations.
      - CMSSignedDataStreamGenerator can now support the generation of DER/DL         encoded SignedData objects (note memory restrictions still apply).
      - It is now possible to add extra digest alorithm IDs to         CMSSignedDataStreamGenerator when required.
      - Random numbers being generated for DSTU4145 signature calculations         were 1 bit shorter than they could be. The code has been corrected         to allow the generated numbers to occupy the full numeric range available.
      - HKDF implementation has been corrected to use multiple IKMs if available.
      - CompositePublic/PrivateKey builders had an issue identifying brainpool         and EdDSA curves from the algorithm names due to an error in the OID         mapping table. This has been fixed.
      - S/MIME: Fix AuthEnveloped support for AES192/GCM and AES256/GCM.
      - CMS: Use implicit tag for AuthEnvelopedData.authEncryptedContentInfo.encryptedContent.
      - Fixed Strings.split to handle delimiters at position 0.
      - Fixed FrodoKEM error sampling to be constant-time.
      - Fixed PKIXNameConstraintValidator to treat a DNS name as intersecting itself.
      - Fixed PKCS12 key stores not calling getInstance with the original provider         (which was forcing provider registration).
      - A resource leak due to the SMIMESigned constructor leaving background         threads hanging on MessagingException has been fixed.
      - OpenPGP: Fixed an issue where a custom signature creation time was         ignored when generating message signatures.
      - OpenPGP: Fixed SKESK encoding for direct-S2K-encrypted messages.

    - Version 1.83:
      - Attempting to check a password on a stripped PGP would throw an         exception. Checking the password on such a key will now always         return false.
      - Fixed an issue in KangarooTwelve where premature absorption caused         erroneous 168-byte padding; absorption is now delayed so correct         final-byte padding is applied.
      - BCJSSE: Fix supported_versions creation for renegotiation handshake.
      - (D)TLS: Reneg info now oly offered with pre-1.3.
      - A generic 'COMPOSITE' algorithm name has been added as a JCA         Signature algorithm. The algorithm will identify the composite         signature to use from the composite key passed in.
      - The composite signatures implementation has been updated to the         final draft and now follows the submitted standard.
      - Support for the generation and use as trust anchors has been added         for certificate signatures with id-alg-unsigned as the signature type.
      - Support for CMP direct POP for encryption keys using         challenge/response has been added to the CMP/CRMF APIs.
      - Support for SupportedCurves attribute to the BC provider
      - BCJSSE: Added support for SLH-DSA signature schemes in TLS 1.3 per         draft-reddy-tls-slhdsa-01.
      - Support has been added for the Java 25 KDF API (current algorithms,         PBKDF2, SCRYPT, and HKDF).
      - Support for composite signatures is now included in CMS and timestamping.
      - It is now possible to disable the Lenstra check in RSA where the public         key is not available via the system/security property         'org.bouncycastle.rsa.no_lenstra_check'.

    - Version 1.82:
      - SNOVA and MAYO are now correctly added to the JCA provider module-info file.
      - TLS: Avoid nonce reuse error in JCE AEAD workaround for pre-Java7.
      - BCJSSE: Session binding map is now shared across all stages of the         session lifecycle (SunJSSE compatibility).
      - The CMCEPrivateKeyParameters#reconstructPublicKey method was returning         an empty byte array. It now returns an encoding of the public key.
      - CBZip2InputStream no longer auto-closes at end-of-contents.
      - The BC CertPath implementation was eliminating certificates on the         bases of the Key-ID. This is not in accordance with RFC 4158.
      - Support for the previous set of libOQS Falcon OIDs has been restored.
      - The BC CipherInputStream could throw an exception if asked to handle an         AEAD stream consisting of the MAC only.
      - Some KeyAgreement classes were missing in the Java 11 class hierarchy.
      - Fix typo in a constant name in the HPKE class and deprecate the old constant.
      - Fuzzing analysis has been done on the OpenPGP API and additional code         has been added to prevent escaping exceptions.
      - SHA3Digest, CSHAKE, TupleHash, KMAC now provide support for Memoable         and EncodableService.
      - BCJSSE: Added support for integrity-only cipher suites in TLS 1.3 per RFC 9150.
      - BCJSSE: Added support for system properties 'jdk.tls.{client,server}.maxInboundCertificateChainLength'
      - BCJSSE: Added support for ML-DSA signature schemes in TLS 1.3 per draft-ietf-tls-mldsa-00.
      - The Composite post-quantum signatures implementation has been updated to         the latest draft (07) draft-ietf-lamps-pq-composite-sigs.
      - '_PREHASH' implementations are now provided for all composite signatures         to allow the hash of the date to be used instead of the actual data in         signature calculation.
      - The gradle build can now be used to generate an Bill of Materials (BOM) file.
      - It is now possible to configure the SignerInfoVerifierBuilder used by the         SignedMailValidator class.
      - The Ascon family of algorithms has been updated with the latest published changes.
      - Composite signature keys can now be constructed from the individual keys of         the algorithms composing the composite.
      - PGPSecretKey, PGPSignatureGenerator now support version 6.
      - Further optimisation work has been done on ML-KEM public key validation.
      - Zeroization of passwords in the JCA PKCS12 key store has been improved.
      - The 'org.bouncycastle.drbg.effective_256bits_entropy' property has been         added for platforms where the entropy source is not producing 1 full bit         of entropy per bit and additional bits are required (default value 282).
      - OpenPGPKeyGenerator now allows for the use of empty UserIDs (version 4 compatibility).
      - The HQC KEM has been updated with the latest draft updates.
      - The legacy post-quantum package has now been removed.

    - Version 1.81:
      - A potention NullPointerException in the KEM KDF KemUtil class         has been removed.
      - Overlapping input/output buffers in doFinal could result in         data corruption.
      - Fixed Grain-128AEAD decryption incorrectly handle MAC verification.
      - Add configurable header validation to prevent malicious header         injection in PGP cleartext signed messages; Fix signature packet         encoding issues in PGPSignature.join() and embedded signatures         while phasing out legacy format.
      - Fixed ParallelHash initialization stall when using block size B=0.
      - The PRF from the PBKDF2 function was been lost when PBMAC1 was         initialized from protectionAlgorithm. This has been fixed.
      - The lowlevel DigestFactory was cloning MD5 when being asked         to clone SHA1.
      - XWing implementation updated to draft-connolly-cfrg-xwing-kem/07/
      - Further support has been added for generation and use of PGP V6 keys
      - Additional validation has been added for armored headers in Cleartext         Signed Messages.
      - The PQC signature algorithm proposal Mayo has been added to the         low-level API and the BCPQC provider.
      - The PQC signature algorithm proposal Snova has been added to the         low-level API and the BCPQC provider.
      - Support for ChaCha20-Poly1305 has been added to the CMS/SMIME APIs.
      - The Falcon implementation has been updated to the latest draft.
      - Support has been added for generating keys which encode as seed-only         and expanded-key-only for ML-KEM and ML-DSA private keys.
      - Private key encoding of ML-DSA and ML-KEM private keys now follows         the latest IETF draft.
      - The Ascon family of algorithms has been updated to the initial draft         of SP 800-232. Some additional optimisation work has been done.
      - Support for ML-DSA's external-mu calculation and signing has been         added to the BC provider.
      - CMS now supports ML-DSA for SignedData generation.
      - Introduce high-level OpenPGP API for message creation/consumption         and certificate evaluation.
      - Added JDK21 KEM API implementation for HQC algorithm.
      - BCJSSE: Strip trailing dot from hostname for SNI, endpointID checks.
      - BCJSSE: Draft support for ML-KEM updated (draft-connolly-tls-mlkem-key-agreement-05).
      - BCJSSE: Draft support for hybrid ECDHE-MLKEM (draft-ietf-tls-ecdhe-mlkem-00).
      - BCJSSE: Optionally prefer TLS 1.3 server's supported_groups order         (BCSSLParameters.useNamedGroupsOrder).

    - Version 1.80:
      - A splitting issue for ML-KEM led to an incorrect size for kemct         in KEMRecipientInfos. This has been fixed.
      - The PKCS12 KeyStore has been adjusted to prevent accidental doubling         of the Oracle trusted certificate attribute (results in an IOException         when used with the JVM PKCS12 implementation).
      - The SignerInfoGenerator copy constructor was ignoring the certHolder field.
      - The getAlgorithm() method return value for a CompositePrivateKey was         not consistent with the corresponding getAlgorithm() return value for         the CompositePrivateKey. This has been fixed.
      - The international property files were missing from the bcjmail distribution.
      - Issues with ElephantEngine failing on processing large/multi-block messages         have been addressed.
      - GCFB mode now fully resets on a reset.
      - The lightweight algorithm contestants: Elephant, ISAP, PhotonBeetle,         Xoodyak now support the use of the AEADParameters class and provide         accurate update/doFinal output lengths.
      - An unnecessary downcast in CertPathValidatorUtilities was resulting         in the ignoring of URLs for FTP based CRLs.
      - A regression in the OpenPGP API could cause NoSuchAlgorithmException         to be thrown when attempting to use SHA-256 in some contexts.
      - EtsiTs1029411TypesAuthorization was missing an extension field.
      - Interoperability issues with single depth LMS keys have been addressed.
      - CompositeSignatures now updated to draft-ietf-lamps-pq-composite-sigs-03.
      - ML-KEM, ML-DSA, SLH-DSA, and Composite private keys now use raw encodings         as per the latest drafts from IETF 121: draft-ietf-lamps-kyber-certificates-06,         draft-ietf-lamps-dilithium-certificates-05, and draft-ietf-lamps-x509-slhdsa.
      - Initial support has been added for RFC 9579 PBMAC1 in the PKCS API.
      - Support has been added for EC-JPAKE to the lightweight API.
      - Support has been added for the direct construction of S/MIME AuthEnvelopedData         objects, via the SMIMEAuthEnvelopedData class.
      - An override 'org.bouncycastle.asn1.allow_wrong_oid_enc' property has been         added to disable new OID encoding checks (use with caution).
      - Support has been added for the PBEParemeterSpec.getParameterSpec()         method where supported by the JVM.
      - ML-DSA/SLH-DSA now return null for Signature.getParameters() if no context         is provided. This allows the algorithms to be used with the existing Java key tool.
      - HQC has been updated to reflect the reference implementation released on 2024-10-30.
      - Support has been added to the low-level APIs for the OASIS Shamir Secret         Splitting algorithms.
      - BCJSSE: System property 'org.bouncycastle.jsse.fips.allowGCMCiphersIn12'         no longer used. FIPS TLS 1.2 GCM suites can now be enabled according to         JcaTlsCrypto#getFipsGCMNonceGeneratorFactory (see JavaDoc for details) if         done in alignment with FIPS requirements.
      - Support has been added for OpenPGP V6 PKESK and message encryption.
      - PGPSecretKey.copyWithNewPassword() now includes AEAD support.
      - The ASCON family of algorithms have been updated in accordance with the         published FIPS SP 800-232 draft.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:12267 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4.

    Security Fix(es):

    * bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons (CVE-2026-5598)

    A Red Hat Security Bulletin which addresses further details about this flaw is available in the References     section.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core     modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-     JAVA: from 1.71 before 1.84. (CVE-2026-5598)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
311742	SUSE SLED15 / SLES15 Security Update : bouncycastle (SUSE-SU-2026:1639-1)	Nessus	SuSE Local Security Checks	critical
311506	RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4.24 (RHSA-2026:12267)	Nessus	Red Hat Local Security Checks	critical
306847	Linux Distros Unpatched Vulnerability : CVE-2026-5598	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-5598

critical

Tenable Plugins

critical

critical

critical