CLEANSTART-2026-YR96935: In Bouncy Castle for Java before 1
CVE-2026-71888 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r5 - Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11 - Upgrade
Upgrade
cleanstart/wso2mito a version that resolves this vulnerability.Fixed in 4.6.0-r9
Event History
Frequently Asked Questions
Which deployments should be prioritized for investigation?
The advisory identifies cleanstart/wso2am, cleanstart/rundeck, and cleanstart/wso2mi as affected software. Prioritize deployments of these packages that include Bouncy Castle for Java versions before the unspecified fixed version.
Can this be exploited remotely without credentials or user interaction?
The supplied vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required. The impact is rated high, with integrity impact marked high.
What fixed version should be deployed?
The available data states only that affected Bouncy Castle for Java versions are before version 1, without providing the complete fixed version. Consult the referenced CVE or advisory details before selecting an upgrade target.