CLEANSTART-2026-SN47760: In Bouncy Castle for Java before 1
Published Nov 14, 2026
·Updated
Security vulnerability affects the elasticsearch package. In Bouncy Castle for Java before 1.
Affected Software
1 affected componentFixes available
cleanstart/elasticsearch<9.5.5-r5
9.5.5-r5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/elasticsearchto a version that resolves this vulnerability.Fixed in 9.5.5-r5
Frequently Asked Questions
1
What access would an attacker need to exploit this issue?
The supplied CVSS vector indicates local access is required, attack complexity is high, no privileges are required, and no user interaction is required.
2
What is the expected security impact if exploitation succeeds?
The CVSS vector indicates a high confidentiality impact, with no integrity or availability impact, and no scope change.
3
Can I determine whether my deployed version is affected from this advisory?
No. The affected-version statement is incomplete: it says Bouncy Castle for Java before version 1, without providing a complete version boundary or a fixed release.