co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-85515 Source advisory...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-85515 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536961...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-85515 Source advisory: MEND:CVE-2026-85515...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-85515 Source advisory...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-12817 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519214...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.1), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +1 more potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (>=1.0.4, <=1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =2.16.0 Source cves: CVE-2026-12817 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519214...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.1), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +1 more potentially affected by CVE-2026-59640 via org.bouncycastle:bcpg-fips (>=1.0.4, <=1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =2.16.0 Source cves: CVE-2026-59640 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512948...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-59640 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-59640 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512948...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-59648 Source advisory...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.1), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +1 more potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-fips (>=1.0.4, <=1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =2.16.0 Source cves: CVE-2026-59649 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512843...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.9.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +111 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.1.13)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.97.0-13 and more Sourc...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-59649 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512843...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-12817 Source advisory: MEND:CVE-2026-12817...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-12817 Source advisory...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-59640 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-59640 Source advisory: MEND:CVE-2026-59640...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-59648 Source advisory: MEND:CVE-2026-59648...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-59648 Source advisory...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-59649 Source advisory: MEND:CVE-2026-59649...

org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.8.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +110 more potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-fips (2.1.11)

org.bouncycastle:bcpg-fips MAVEN version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - org.opensearch:opensearch-plugin-cli =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09,...

Improper Certificate Validation

Overview org.opensearch.dataprepper.plugins:opensearch is a Data Prepper project: opensearch Affected versions of this package are vulnerable to Improper Certificate Validation in the SSL certificate validation process when the cert parameter is not explicitly provided. An attacker can intercept...