Executive brief
Bouncy Castle is a widely used Java library that provides cryptographic functions for securing data and communications. A vulnerability in its implementation of the FrodoKEM algorithm could allow an attacker to observe the time it takes to perform certain operations to potentially recover sensitive cryptographic keys. This could lead to the unauthorized decryption of private communications or the compromise of protected data.
Technical details
A covert timing channel vulnerability (CWE-385) exists in the Bouncy Castle Java (BC-JAVA) library within the FrodoEngine.java component. The flaw is specifically located in the FrodoKEM algorithm's decryption of encapsulations, where variations in processing time can leak information about the underlying cryptographic keys. An attacker with network access can exploit these timing differences without requiring authentication or user interaction. Successful exploitation could lead to high-impact compromises of confidentiality and integrity. The issue has been addressed in versions 1.80.2, 1.81.1, and 1.84.
Affected products
- Bouncy Castle BC-JAVA (bcprov-jdk15to18) >= 1.71, < 1.80.2
- Bouncy Castle BC-JAVA (bcprov-jdk14) >= 1.81, < 1.81.1
- Bouncy Castle BC-JAVA (bcprov-jdk18on) >= 1.82, < 1.84
Timeline
- 2026-04-15: advisory: NVD publication date
- 2026-04-17: disclosed: GitHub Advisory published
- 2026-06-19: other: Advisory last updated