CLEANSTART-2026-IM57692: In Bouncy Castle for Java before 1

Q: Which managed components are flagged by this advisory?

The affected software entries are cleanstart/wso2am, cleanstart/rundeck, and cleanstart/wso2mi.

Q: What does an attacker need to exploit this issue?

The vector indicates network access is sufficient, with low attack complexity and no required privileges. User interaction is required.

Q: What impact is indicated if exploitation succeeds?

The supplied metrics indicate no confidentiality or integrity impact and a low availability impact. The listed severity is medium, with a score of 5.3.

Published Nov 13, 2026

Updated

CVE-2026-17508 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/wso2am<4.7.0-r5

4.7.0-r5

cleanstart/rundeck<6.0.1-r11

6.0.1-r11

cleanstart/wso2mi<4.6.0-r9

4.6.0-r9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2am to a version that resolves this vulnerability.
Fixed in 4.7.0-r5
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.0.1-r11
Upgrade
Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.
Fixed in 4.6.0-r9

Event History

Nov 13, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-17508

Frequently Asked Questions

Which managed components are flagged by this advisory?