CLEANSTART-2026-WO34439: In Bouncy Castle for Java before 1

Q: What does the CVSS vector indicate about exploitation prerequisites?

The assessment indicates network-reachable exploitation with low attack complexity, no required privileges, and no user interaction. It also indicates that an additional attack requirement is present.

Q: What is the expected security impact if exploitation succeeds?

The vector rates confidentiality and integrity impact as high, while availability impact is rated low. No subsequent-system confidentiality, integrity, or availability impact is indicated.

Q: Which component should be investigated first?

The affected software is identified as the cleanstart/keycloak package. The advisory associates the issue with Bouncy Castle for Java before version 1, but does not provide a complete affected-version range or a fixed version.

Published Nov 5, 2026

Updated

Security vulnerability affects the keycloak package. In Bouncy Castle for Java before 1.

Affected Software

1 affected componentFixes available

cleanstart/keycloak<26.8.1-r1

26.8.1-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/keycloak to a version that resolves this vulnerability.
Fixed in 26.8.1-r1

Event History

Nov 5, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-71885

Frequently Asked Questions

What does the CVSS vector indicate about exploitation prerequisites?

The assessment indicates network-reachable exploitation with low attack complexity, no required privileges, and no user interaction. It also indicates that an additional attack requirement is present.

What is the expected security impact if exploitation succeeds?

The vector rates confidentiality and integrity impact as high, while availability impact is rated low. No subsequent-system confidentiality, integrity, or availability impact is indicated.

Which component should be investigated first?

The affected software is identified as the cleanstart/keycloak package. The advisory associates the issue with Bouncy Castle for Java before version 1, but does not provide a complete affected-version range or a fixed version.

CLEANSTART-2026-WO34439: In Bouncy Castle for Java before 1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does the CVSS vector indicate about exploitation prerequisites?

What is the expected security impact if exploitation succeeds?

Which component should be investigated first?

Company

Resources

Contact

Frequently Asked Questions

What does the CVSS vector indicate about exploitation prerequisites?

What is the expected security impact if exploitation succeeds?

Which component should be investigated first?