CLEANSTART-2026-LD74483: In Bouncy Castle for Java before 1
Published Nov 13, 2026
·Updated
CVE-2026-71887 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.
Affected Software
2 affected componentsFixes available
cleanstart/wso2am<4.7.0-r5
4.7.0-r5
cleanstart/rundeck<6.0.1-r11
6.0.1-r11
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r5 - Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11
Event History
Nov 13, 2026
Advisory Published
via OSV·12:36 AM
Data Sourced
via OSV·12:36 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which deployed products should be prioritized for review?
The affected software list identifies cleanstart/wso2am and cleanstart/rundeck. No affected product versions are provided in the available data.
2
What attacker access is indicated by the severity vector?
The vector indicates network reachability, low attack complexity, no required privileges, and no user interaction. It also indicates that attack requirements are present (AT:P), so exploitation depends on conditions not specified in the available data.