CLEANSTART-2026-NT89541: In Bouncy Castle for Java before 1

Q: Which deployment is identified as affected?

The advisory identifies the cleanstart/sonarqube software package as affected and describes the issue as involving Bouncy Castle for Java before version 1.

Q: Can this issue be exploited remotely without credentials or user interaction?

The supplied vector indicates network attack access, low attack complexity, no required privileges, and no user interaction. It also indicates limited confidentiality and integrity impact, with no availability impact.

Q: What fixed version should be deployed?

The provided data only states that Bouncy Castle for Java versions before 1 are affected. It does not identify a specific fixed release or the affected dependency version used by the package.

Published Nov 12, 2026

Updated

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1.

Affected Software

1 affected componentFixes available

cleanstart/sonarqube<26.10.0.133078-r1

26.10.0.133078-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.10.0.133078-r1

Event History

Nov 12, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-71892

Frequently Asked Questions

Which deployment is identified as affected?

The advisory identifies the cleanstart/sonarqube software package as affected and describes the issue as involving Bouncy Castle for Java before version 1.

Can this issue be exploited remotely without credentials or user interaction?

The supplied vector indicates network attack access, low attack complexity, no required privileges, and no user interaction. It also indicates limited confidentiality and integrity impact, with no availability impact.

What fixed version should be deployed?

The provided data only states that Bouncy Castle for Java versions before 1 are affected. It does not identify a specific fixed release or the affected dependency version used by the package.

CLEANSTART-2026-NT89541: In Bouncy Castle for Java before 1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployment is identified as affected?

Can this issue be exploited remotely without credentials or user interaction?

What fixed version should be deployed?

Company

Resources

Contact

Frequently Asked Questions

Which deployment is identified as affected?

Can this issue be exploited remotely without credentials or user interaction?

What fixed version should be deployed?