PkgSeer

Vulnerability GHSA-p93r-85wp-75v3

High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
6 months ago
April 17, 2026 at 06:31 PM UTC
Bouncy Castle Has Covert Timing Channel Vulnerability
1.71 - 1.83
1.71 - 1.83

Summary

Bouncy Castle Has Covert Timing Channel Vulnerability

Details

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java.

This issue only affects users of the FrodoKEM algorithm involved in the decryption of encapsulations.

This issue affects BC-JAVA: from 1.71 to 1.80.1, 1.81, 1.82 to 1.83.

Fixed versions: 1.80.2, 1.81.1, 1.84

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk
3 months ago
Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard
1.71 - 1.84 GHSA-qp49-qgx5-5m26
1.71 - 1.84 GHSA-qp49-qgx5-5m26
High Risk
3 months ago
Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard
1.71 - 1.84 GHSA-qp49-qgx5-5m26
1.71 - 1.84 GHSA-qp49-qgx5-5m26
Critical
3 months ago
Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI
1.71 - 1.84 GHSA-9pwp-9qqc-pr26
1.71 - 1.84 GHSA-9pwp-9qqc-pr26
Critical
3 months ago
Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI
1.71 - 1.84 GHSA-9pwp-9qqc-pr26
1.71 - 1.84 GHSA-9pwp-9qqc-pr26
High Risk
6 months ago
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
1.59 - 1.83 GHSA-574f-3g2m-x479
1.59 - 1.83 GHSA-574f-3g2m-x479
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
6 months ago
April 17, 2026 at 06:31 PM UTC
Fixed (1.84)
Unknown
Unknown
Fixed (1.84)
Unknown
Unknown
Fixed (1.80.2)
Unknown
Unknown
Last Modified
7 hours ago
November 04, 2026 at 03:30 AM UTC