CLEANSTART-2026-WW31438: In Bouncy Castle for Java before 1

Q: Which deployments should be reviewed first?

The record lists cleanstart/sonarqube and cleanstart/elasticsearch as the affected software entries. Review their Bouncy Castle for Java dependency versions and package composition.

Q: Does this record identify the individual affected packages or a complete fixed version?

No. It states that multiple packages are affected and directs readers to the referenced advisory and CVE records for individual vulnerability details; the version information in this record is limited to “before 1.”

Published Nov 7, 2026

Updated

CVE-2026-71889 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.

Affected Software

4 affected componentsFixes available

cleanstart/sonarqube<26.7.0.124771-r11

26.7.0.124771-r11

cleanstart/sonarqube<26.8.0.126808-r6

26.8.0.126808-r6

cleanstart/elasticsearch<9.5.5-r2

9.5.5-r2

cleanstart/elasticsearch<9.5.5-r3

9.5.5-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.7.0.124771-r11
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.8.0.126808-r6
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r2
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r3

Event History

Nov 7, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-71889

Frequently Asked Questions

Which deployments should be reviewed first?

The record lists cleanstart/sonarqube and cleanstart/elasticsearch as the affected software entries. Review their Bouncy Castle for Java dependency versions and package composition.

Does this record identify the individual affected packages or a complete fixed version?

No. It states that multiple packages are affected and directs readers to the referenced advisory and CVE records for individual vulnerability details; the version information in this record is limited to “before 1.”

CLEANSTART-2026-WW31438: In Bouncy Castle for Java before 1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be reviewed first?

Does this record identify the individual affected packages or a complete fixed version?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be reviewed first?

Does this record identify the individual affected packages or a complete fixed version?