CLEANSTART-2026-WG31965: In Bouncy Castle for Java before 1

Q: Which deployments should be prioritized for triage?

The affected software entries identify cleanstart/wso2mi, cleanstart/sonarqube, and cleanstart/elasticsearch. The available data does not specify affected versions or configurations for those products.

Q: When was this advisory published?

It was published on 2026-11-07.

Published Nov 7, 2026

Updated

CVE-2026-71891 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.

Affected Software

7 affected componentsFixes available

cleanstart/sonarqube<26.8.0.126808-r6

26.8.0.126808-r6

cleanstart/wso2mi<4.3.0-r0

4.3.0-r0

cleanstart/wso2mi<4.4.0-r0

4.4.0-r0

cleanstart/wso2mi<4.5.0-r0

4.5.0-r0

cleanstart/sonarqube<26.7.0.124771-r11

26.7.0.124771-r11

cleanstart/elasticsearch<9.5.5-r2

9.5.5-r2

cleanstart/elasticsearch<9.5.5-r3

9.5.5-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.8.0.126808-r6
Upgrade
Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.
Fixed in 4.3.0-r0
Upgrade
Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.
Fixed in 4.4.0-r0
Upgrade
Upgrade cleanstart/wso2mi to a version that resolves this vulnerability.
Fixed in 4.5.0-r0
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.7.0.124771-r11
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r2
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r3

Event History

Nov 7, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-71891

Frequently Asked Questions

Which deployments should be prioritized for triage?

The affected software entries identify cleanstart/wso2mi, cleanstart/sonarqube, and cleanstart/elasticsearch. The available data does not specify affected versions or configurations for those products.

When was this advisory published?