CLEANSTART-2026-SG98214: In Bouncy Castle for Java before 1
Security vulnerability affects the elasticsearch package. In Bouncy Castle for Java before 1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/elasticsearchto a version that resolves this vulnerability.Fixed in 9.5.5-r5
Frequently Asked Questions
What does an attacker need to exploit this issue?
The available severity vector indicates exploitation can be performed over the network with low attack complexity, without privileges or user interaction.
What is the expected security impact?
The severity vector indicates a high impact on integrity. It indicates no direct impact on confidentiality or availability.
How can I determine whether an installation may be affected?
Review whether the deployment uses the cleanstart/elasticsearch package and identify its Bouncy Castle for Java version. The advisory states that affected versions are before a version beginning with “1,” but does not provide the complete version boundary in the available data.