CLEANSTART-2026-GS77806: In Bouncy Castle for Java before 1

Q: Which components are listed as affected by this advisory?

The advisory lists cleanstart/sonarqube and cleanstart/elasticsearch. It also states that CVE-2026-71892 affects multiple packages, but does not provide component-specific version ranges.

Q: Can I determine whether a deployed instance is vulnerable from this record alone?

No. The available version information is incomplete, stating only that Bouncy Castle for Java is affected before version 1, without identifying a complete fixed version or the dependency versions used by the listed components.

Published Nov 7, 2026

Updated

CVE-2026-71892 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.

Affected Software

4 affected componentsFixes available

cleanstart/sonarqube<26.7.0.124771-r11

26.7.0.124771-r11

cleanstart/sonarqube<26.8.0.126808-r6

26.8.0.126808-r6

cleanstart/elasticsearch<9.5.5-r2

9.5.5-r2

cleanstart/elasticsearch<9.5.5-r3

9.5.5-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.7.0.124771-r11
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.8.0.126808-r6
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r2
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r3

Event History

Nov 7, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-71892

Frequently Asked Questions

Which components are listed as affected by this advisory?