CLEANSTART-2026-MT77435: In Bouncy Castle for Java before 1

Q: Is a complete fixed version provided?

No. The available data only states that Bouncy Castle for Java is affected before a version beginning with “1”; it does not provide a complete fixed version number.

Q: Can I determine whether a particular deployment is exploitable from this advisory?

No. The available data does not specify affected configurations, attack prerequisites beyond network access and no privileges or user interaction in the severity vector, or indicators of compromise.

Q: Which software should be prioritized for review?

The affected software entry is cleanstart/apache-nifi. Review its bundled or declared Bouncy Castle for Java version against authoritative upstream remediation information.

Published Nov 11, 2026

Updated

Security vulnerability affects the apache-nifi package. In Bouncy Castle for Java before 1.

Affected Software

1 affected componentFixes available

cleanstart/apache-nifi<2.11.0-r3

2.11.0-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/apache-nifi to a version that resolves this vulnerability.
Fixed in 2.11.0-r3

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-71886

Frequently Asked Questions

Is a complete fixed version provided?

No. The available data only states that Bouncy Castle for Java is affected before a version beginning with “1”; it does not provide a complete fixed version number.

Can I determine whether a particular deployment is exploitable from this advisory?

No. The available data does not specify affected configurations, attack prerequisites beyond network access and no privileges or user interaction in the severity vector, or indicators of compromise.

Which software should be prioritized for review?

The affected software entry is cleanstart/apache-nifi. Review its bundled or declared Bouncy Castle for Java version against authoritative upstream remediation information.

CLEANSTART-2026-MT77435: In Bouncy Castle for Java before 1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Is a complete fixed version provided?

Can I determine whether a particular deployment is exploitable from this advisory?

Which software should be prioritized for review?

Company

Resources

Contact

Frequently Asked Questions

Is a complete fixed version provided?

Can I determine whether a particular deployment is exploitable from this advisory?

Which software should be prioritized for review?