CLEANSTART-2026-YH04594: In Bouncy Castle for Java before 1

Q: Does exploitation require authentication or elevated privileges?

No privileges are required according to the provided vector. Exploitation is network-accessible, has low attack complexity, and requires user interaction.

Q: What is the expected security impact if exploitation succeeds?

The provided vector indicates a high impact on integrity. It does not indicate a direct impact on confidentiality or availability.

Q: Can a precise fixed version be identified from this advisory?

No. The supplied version information only states “before 1,” so it does not provide a complete version boundary for determining whether a deployment is patched.

Q: Is exploit availability known?

No. The exploit-maturity field is marked as unknown in the provided vector.

Published Nov 14, 2026

Updated

Security vulnerability affects the elasticsearch package. In Bouncy Castle for Java before 1.

Affected Software

1 affected componentFixes available

cleanstart/elasticsearch<9.5.5-r5

9.5.5-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r5

Event History

Nov 14, 2026

Advisory Published

via OSV·12:35 AM

Data Sourced

via OSV·12:35 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-71891

Frequently Asked Questions

Does exploitation require authentication or elevated privileges?

No privileges are required according to the provided vector. Exploitation is network-accessible, has low attack complexity, and requires user interaction.

What is the expected security impact if exploitation succeeds?

The provided vector indicates a high impact on integrity. It does not indicate a direct impact on confidentiality or availability.

Can a precise fixed version be identified from this advisory?

No. The supplied version information only states “before 1,” so it does not provide a complete version boundary for determining whether a deployment is patched.

Is exploit availability known?

No. The exploit-maturity field is marked as unknown in the provided vector.

CLEANSTART-2026-YH04594: In Bouncy Castle for Java before 1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require authentication or elevated privileges?

What is the expected security impact if exploitation succeeds?

Can a precise fixed version be identified from this advisory?

Is exploit availability known?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or elevated privileges?

What is the expected security impact if exploitation succeeds?

Can a precise fixed version be identified from this advisory?

Is exploit availability known?