Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
Bouncy Castle for Java before version 1 can run malicious code
published 5 days ago
Summary
Older versions of the Bouncy Castle cryptography library for Java may let specially crafted data cause the program to execute unintended code. This puts any application that uses the library at risk of being compromised. Upgrade the library to the newest release and test your applications to confirm the update resolves the issue.
What to do
- Update cleanstart gradle to version 7.6.6-r0.
- Update cleanstart spark-sc213-jdk17-py312 to version 4.2.0-r1.
- Update cleanstart gradle to version 8.14.5-r1.
- Update cleanstart wso2is to version 7.1.0-r1.
- Update cleanstart wso2is to version 7.3.0-r1.
- Update cleanstart wso2is to version 7.0.0-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | gradle |
< 7.6.6-r0 < 8.14.5-r1 Fix: upgrade to 7.6.6-r0
|
| CleanStart | cleanstart | spark-sc213-jdk17-py312 |
< 4.2.0-r1 Fix: upgrade to 4.2.0-r1
|
| CleanStart | cleanstart | wso2is |
< 7.1.0-r1 < 7.3.0-r1 < 7.0.0-r1 Fix: upgrade to 7.1.0-r1
|
Original advisory text
In Bouncy Castle for Java before 1
CVE-2026-12185 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-IT21641 · OSV
Track software like this
Free during beta