CLEANSTART-2026-QY97145: In Bouncy Castle for Java before 1
Security vulnerability affects the keycloak package. In Bouncy Castle for Java before 1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/keycloakto a version that resolves this vulnerability.Fixed in 26.7.5-r3
Event History
Frequently Asked Questions
Which deployments should be investigated?
Investigate deployments of cleanstart/keycloak that include Bouncy Castle for Java. The available data does not provide a complete affected-version boundary beyond stating “before 1,” so component inventory and the referenced advisory should be used to determine exposure.
What does an attacker need to exploit this issue?
The supplied vector indicates network reachability, low attack complexity, no required privileges, and required user interaction. This suggests an attacker can attempt exploitation remotely but needs a user to perform an interaction.
What is the expected security impact?
The supplied severity vector indicates no confidentiality or integrity impact and a low availability impact. The overall base severity is medium, with a score of 5.3.