Description
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).
This vulnerability is associated with program files FrodoEngine.Java.
This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Legion of the Bouncy Castle | BC-JAVA | 1.71 – < 1.80.2, 1.81 – < 1.81.1, 1.82 – < 1.84 | 1.80.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bouncycastle | 1.86-1 | — |
| Debian 13 | bouncycastle | No fix yet | — |
| Debian 12 | bouncycastle | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | bouncycastle | No fix yet | — |
| Ubuntu 26.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu 25.10 | bouncycastle | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu Pro 22.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu Pro 20.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu Pro 18.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | bouncycastle | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-activemq-artemis +15 | 2.16.0-22.redhat_00057.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-bouncycastle +5 | 1.84.0-1.redhat_00001.1.el7eap | RHSA-2026:12267 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-glassfish-jsf | 2.3.14-11.SP11_redhat_00001.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-ironjacamar +8 | 1.5.26-2.Final_redhat_00001.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jackson-core +10 | 2.18.8-1.redhat_00003.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-remoting | 5.0.31-3.SP2_redhat_00001.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-server-migration +2 | 1.10.0-46.Final_redhat_00044.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-netty +26 | 4.1.135-1.Final_redhat_00001.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-picketlink-api +7 | 2.5.5-24.SP12_redhat_00016.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-picketlink-bindings +1 | 2.5.5-30.SP12_redhat_00020.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-undertow | 2.2.40-1.SP3_redhat_00001.1.el8eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly +4 | 7.4.25-2.GA_redhat_00001.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly-java-jdk17 | 7.4.25-2.GA_redhat_00001.1.el8eap | RHSA-2026:53646, RHSA-2026:53645 |
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.40.0-6.redhat_00012.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-angus +1 | 2.0.5-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-angus-activation | 2.0.3-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.84.0-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.6.0-1.GA_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-guava +1 | 33.0.0-3.jre_redhat_00004.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-guava-failureaccess | 1.0.3-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hal-console | 3.7.19-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.6.48-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hibernate-search +6 | 7.2.6-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jakarta-activation | 2.1.4-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jboss-logging | 3.6.2-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jboss-metadata +5 | 16.1.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jctools +1 | 4.0.6-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.132-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-plexus-utils | 3.6.1-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava | 3.1.12-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava2 | 2.2.21-5.redhat_00003.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.6-5.GA_redhat_00007.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-client-config | 1.0.1-4.Final_redhat_00002.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-http-client +4 | 2.1.4-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-javadocs | 8.1.1-10.GA_redhat_00017.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl +1 | 2.3.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl-el8-x86_64 | 2.3.0-1.Final.redhat.00001.1.el8eap | RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl-el9-x86_64 | 2.3.0-1.Final_redhat_00001.1.el9eap | RHSA-2026:18055 |
| Red Hat JBoss EAP 8 | eap8-yasson | 3.0.4-5.redhat_00007.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bouncycastle | 1.84-1.1 | openSUSE-SU-2026:10571-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-nifi | 2.9.0-r0 | — |
| Wolfi rolling | apache-pulsar-4.2 | 4.2.1-r0 | — |
| Wolfi rolling | druid | 36.0.0-r15 | — |
| Wolfi rolling | gradle-8 | 8.14.4-r4 | — |
| Wolfi rolling | gradle-9 | 9.4.1-r2 | — |
| Wolfi rolling | jenkins-2-openjdk-21 +1 | 2.560-r0 | — |
| Wolfi rolling | jruby-10.1 | 10.1.0.0-r1 | — |
| Wolfi rolling | jruby-9.4 | 9.4.14.0-r5 | — |
| Wolfi rolling | keycloak-26.5 +3 | No fix yet | — |
| Wolfi rolling | keycloak-26.6 +1 | 26.6.1-r4 | — |
| Wolfi rolling | kserve-modelmesh | 0.12.0-r31 | — |
| Wolfi rolling | logstash-9.3 +1 | 9.3.5-r0 | — |
| Wolfi rolling | logstash-9.4 +1 | 9.4.1-r3 | — |
| Wolfi rolling | ruby3.2-bouncy-castle-java | 1.5.0146.1-r8 | — |
| Wolfi rolling | ruby3.3-bouncy-castle-java | 1.5.0146.1-r6 | — |
| Wolfi rolling | ruby3.4-bouncy-castle-java | 1.5.0146.1-r7 | — |
| Wolfi rolling | ruby4.0-bouncy-castle-java | 1.5.0146.1-r3 | — |
| Wolfi rolling | sonarqube | 26.6.0.123539-r0 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.2-r11 | — |
| Wolfi rolling | thingsboard-tb-node +1 | 4.3.1.2-r0 | — |
| Wolfi rolling | wildfly-openjdk-17 +1 | 39.0.1-r5 | — |
| Wolfi rolling | zipkin +1 | 3.6.1-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.bouncycastle:bcprov-jdk14 | >= 1.71, < 1.84 | 1.84 | GHSA-p93r-85wp-75v3 |
| Maven | org.bouncycastle:bcprov-jdk15to18 | >= 1.71, < 1.80.2 | 1.80.2 | GHSA-p93r-85wp-75v3 |
| Maven | org.bouncycastle:bcprov-jdk18on | >= 1.82, < 1.84 | 1.84 | GHSA-p93r-85wp-75v3 |
| Maven | org.bouncycastle:bcprov-jdk18on | >= 1.81, < 1.84 | 1.84 | GHSA-p93r-85wp-75v3 |
| Maven | org.bouncycastle:bcprov-jdk18on | >= 1.71, < 1.80.2 | 1.80.2 | GHSA-p93r-85wp-75v3 |
Advisories 13
- WID-SEC-2026-1327 Red Hat JBoss Enterprise Application Platform (bouncycastle): Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 3, 2026
- NCSC-2026-0448 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Oct 22, 2026
- WID-SEC-2026-4078 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
- RHSA-2026:53646 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:53645 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:53644 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:18055 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:18054 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:12267 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2444 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 7, 2026
- WID-SEC-2026-2460 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- WID-SEC-2026-1608 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 19, 2026
- openSUSE-SU-2026:10571-1 bouncycastle-1.84-1.1 on GA media SUSE / openSUSE Security Updates · Apr 19, 2026