CLEANSTART-2026-WP73469: In Bouncy Castle for Java before 1

Q: What conditions are required for exploitation?

The available vector indicates network reachability, low attack complexity, no required attacker privileges, and required user interaction. The affected component is identified as the keycloak package using Bouncy Castle for Java.

Q: What is the likely security impact?

The provided severity vector indicates no confidentiality or integrity impact and a low availability impact. It does not provide details about the specific denial-of-service condition or affected functionality.

Q: Can the affected version range be determined from the available information?

No. The version statement is truncated as “before 1,” so the precise fixed version and complete affected range cannot be determined from the provided data.

Published Nov 6, 2026

Updated

Security vulnerability affects the keycloak package. In Bouncy Castle for Java before 1.

Affected Software

1 affected componentFixes available

cleanstart/keycloak<26.7.5-r3

26.7.5-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/keycloak to a version that resolves this vulnerability.
Fixed in 26.7.5-r3

Event History

Nov 6, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97873

Frequently Asked Questions

What conditions are required for exploitation?

The available vector indicates network reachability, low attack complexity, no required attacker privileges, and required user interaction. The affected component is identified as the keycloak package using Bouncy Castle for Java.

What is the likely security impact?

The provided severity vector indicates no confidentiality or integrity impact and a low availability impact. It does not provide details about the specific denial-of-service condition or affected functionality.

Can the affected version range be determined from the available information?

No. The version statement is truncated as “before 1,” so the precise fixed version and complete affected range cannot be determined from the provided data.

CLEANSTART-2026-WP73469: In Bouncy Castle for Java before 1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

What is the likely security impact?

Can the affected version range be determined from the available information?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the likely security impact?

Can the affected version range be determined from the available information?