CLEANSTART-2026-KU99523: In Bouncy Castle for Java before 1

Q: Which tracked applications should be investigated first?

The record lists cleanstart/apache-nifi and cleanstart/keycloak as associated software. Review the Bouncy Castle for Java packages and versions bundled with or used by those deployments.

Q: Does this record provide a complete affected-version range or fixed version?

No. The affected-version statement is incomplete, and the record does not provide a fixed version. Consult the referenced CVE details for the individual package and version information.

Published Nov 11, 2026

Updated

CVE-2026-18040 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/apache-nifi<2.11.0-r3

2.11.0-r3

cleanstart/keycloak<26.6.4-r8

26.6.4-r8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/apache-nifi to a version that resolves this vulnerability.
Fixed in 2.11.0-r3
Upgrade
Upgrade cleanstart/keycloak to a version that resolves this vulnerability.
Fixed in 26.6.4-r8

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-18040

Frequently Asked Questions

Which tracked applications should be investigated first?

The record lists cleanstart/apache-nifi and cleanstart/keycloak as associated software. Review the Bouncy Castle for Java packages and versions bundled with or used by those deployments.

Does this record provide a complete affected-version range or fixed version?

No. The affected-version statement is incomplete, and the record does not provide a fixed version. Consult the referenced CVE details for the individual package and version information.

CLEANSTART-2026-KU99523: In Bouncy Castle for Java before 1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which tracked applications should be investigated first?

Does this record provide a complete affected-version range or fixed version?

Company

Resources

Contact

Frequently Asked Questions

Which tracked applications should be investigated first?

Does this record provide a complete affected-version range or fixed version?