CLEANSTART-2026-VF22608 Security fixes in elasticsearch 9.3.8-r2

Package elasticsearch version 9.3.8-r2 fixes 8 vulnerabilities: CVE-2026-13505, CVE-2026-12817, CVE-2026-59640, CVE-2026-59649, CVE-2026-58062...

amdonov.ospackage-init:amdonov.ospackage-init.gradle.plugin (>=0.1.0, <=0.5.0), app.cash.backfila:client-misk-dynamodb (>=0.1.3-20210127.1838-76ab4fc, <=0.1.4-20210806.0204-5341f38) +1653 more potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-jdk15on (>=1.46, <=1.70)

org.bouncycastle:bcpg-jdk15on MAVEN version =1.46, =0.1.0, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210127.1838-76ab4fc, =2023.06.07.114626-93b9d6f, =0.1.3-20210127.1838-76ab4fc, =0.1.4-20220614.0152-5ae0eef, =1.0.0-m11, =1.0.0-m6, =1.0.0-m11, =0.0.1-m20, =0.0.1-m20, =0.0.1-m27, =1.0.0-m11,...

CVE-2026-59649

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

Linux Distros Unpatched Vulnerability : CVE-2026-59649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LT...

SUSE CVE-2026-59649

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...