StackRadar

CVE-2026-0636

Medium

Advisory

Published 15 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.005
43rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
124
of 17,781 indexed, latest versions
Container images
131
deployed by those charts
Fix available
2 of 3
affected packages

Bouncy Castle has an LDAP injection

Carried by container images the latest versions of 124 of 17,781 indexed charts deploy, on 131 images.

Affected packageAffected versionsFixed inImages
bcprov-jdk18onmaven1.74, 1.75, 1.76, 1.77+9 more1.84124
bcprov-jdk15to18maven1.74, 1.75, 1.76, 1.78+4 more1.8415
bouncycastledeb1.61-1no fix listed1
OSV records
GHSA-c3fc-8qff-9hwxUBUNTU-CVE-2026-0636

Charts affected

124 by stars
ChartLatestAffected imagesRadar Score
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
opensearchproject/opensearch:3.1.0474ea3fdf25d
bcprov-jdk18on@1.81
1.84

Open the chart page →

71,208
timesketchosdfir-infrastructureVerified publisher1.0.81 of 6See more

timesketch osdfir-infrastructure 1.0.8

1 of the 6 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.14.0466a49f379bb
bcprov-jdk15to18@1.75
bcprov-jdk18on@1.78
1.84
1.84

Open the chart page →

1,753
keycloakpascaliskeVerified publisher0.2.01 of 1See more

keycloak pascaliske 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.0.74388e2379b7e
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

2,097
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
bcprov-jdk18on@1.77
1.84

Open the chart page →

5,269
radar-gatewayradar-baseVerified publisher1.9.01 of 2See more

radar-gateway radar-base 1.9.0

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

2,284
radar-outputradar-baseVerified publisher1.2.101 of 1See more

radar-output radar-base 1.2.10

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure:3.0.67fb9c70e96a4
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

2,465
sonarquberedhat-cop0.1.131 of 1See more

sonarqube redhat-cop 0.1.13

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
library/sonarqube:10.7.0-community0842dcd4c8f8
bcprov-jdk18on@1.76
1.84

Open the chart page →

4,203
keycloaksb-helm-charts0.3.01 of 2See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.0.6a93d22e13b86
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

2,590
keycloaksikalabs0.1.01 of 1See more

keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.3.36a7217a100bd
bcprov-jdk18on@1.81
1.84

Open the chart page →

1,690
sonatype-nexus3simcube1.0.11 of 2See more

sonatype-nexus3 simcube 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
sonatype/nexus3:3.58.1586060431b64
bcprov-jdk15to18@1.75
1.84

Open the chart page →

4,946
teku-validatorstakewise4.3.21 of 2See more

teku-validator stakewise 4.3.2

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
consensys/teku:25.4.1bf6ecd2ea716
bcprov-jdk18on@1.80
1.84

Open the chart page →

3,153
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
bcprov-jdk18on@1.79
1.84

Open the chart page →

1,827
wonder-mesh-netstrrl-helm2026.629.01 of 3See more

wonder-mesh-net strrl-helm 2026.629.0

1 of the 3 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.009a381c715ab
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

5,063
netforge-besvtechVerified publisher0.0.21 of 3See more

netforge-be svtech 0.0.2

1 of the 3 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
conductoross/conductor:3.31.09fba127693e6
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

4,674
configservertwomartensVerified publisher0.2.01 of 1See more

configserver twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
2martens/configserver:latestbf1cdb80239d
bcprov-jdk18on@1.78
1.84

Open the chart page →

2,144
timetabletwomartensVerified publisher0.2.01 of 1See more

timetable twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
2martens/timetable:latestbd1ba6ab84c9
bcprov-jdk18on@1.80
1.84

Open the chart page →

1,527
wahlrechttwomartensVerified publisher0.3.01 of 1See more

wahlrecht twomartens 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
2martens/wahlrecht:latestba2c3040dab0
bcprov-jdk18on@1.80
1.84

Open the chart page →

1,689
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.1.4044a457e0498
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

45,239
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.49c344d2b1757
bcprov-jdk15to18@1.78.1
bcprov-jdk18on@1.82
1.84
1.84

Open the chart page →

5,484
hazelcastwenerme5.10.21 of 2See more

hazelcast wenerme 5.10.2

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
hazelcast/management-center:5.5.2991ddb27c251
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

2,634
elasticsearchwiremindVerified publisher8.19.01 of 1See more

elasticsearch wiremind 8.19.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
library/elasticsearch:8.19.1289729a95066a
bcprov-jdk18on@1.79
1.84

Open the chart page →

2,191
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
bcprov-jdk18on@1.82
1.84

Open the chart page →

7,624
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
bcprov-jdk15to18@1.78.1
bcprov-jdk18on@1.78.1
1.84
1.84

Open the chart page →

9,381
zipkinzipkinVerified publisher0.5.01 of 1See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
openzipkin/zipkin-slim:3.6.0a69e1057df36
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

1,159

Container images carrying it

131 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
geoservercloud/geoserver-cloud-gwc:3.0.1.1b04ed89b5d2b
bcprov-jdk18on@1.81.1
1.84
1
geoservercloud/geoserver-cloud-rest:3.0.1.1318254b52f96
bcprov-jdk18on@1.81.1
1.84
1
geoservercloud/geoserver-cloud-wcs:3.0.1.14f077124f591
bcprov-jdk18on@1.81.1
1.84
1
geoservercloud/geoserver-cloud-webui:3.0.1.14f91e3048ac8
bcprov-jdk18on@1.81.1
1.84
1
geoservercloud/geoserver-cloud-wfs:3.0.1.1299f0d6232d1
bcprov-jdk18on@1.81.1
1.84
1
geoservercloud/geoserver-cloud-wms:3.0.1.15164f687ce4d
bcprov-jdk18on@1.81.1
1.84
1
glarad/mc-service-registry:latest7b02b9e7f1ef
bcprov-jdk18on@1.82
1.84
1
glasskube/operator:0.12.2be5133100d63
bcprov-jdk15to18@1.76
bcprov-jdk18on@1.74
1.84
1.84
1
golenski/fibonacci-msg-relay:1.0.0c863dcb0c513
bcprov-jdk18on@1.77
1.84
1
golenski/fibonacci-task-manager:2.0.03a2b36df247b
bcprov-jdk18on@1.77
1.84
1
golenski/fibonacci-worker:2.0.0954caf4aaf6a
bcprov-jdk18on@1.77
1.84
1
gridgain/gridgain9:9.1.1895018390077b
bcprov-jdk18on@1.83
1.84
1
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
bcprov-jdk18on@1.77
1.84
1
jenkins/jenkins:2.462.2-jdk1795313257a8cd
bcprov-jdk18on@1.78.1
1.84
1
jenkins/jenkins:2.440.3-jdk17de4fea113221
bcprov-jdk18on@1.77
1.84
1
keyfactor/signserver-ce:7.3.2798fbbe00283
bcprov-jdk18on@1.80
1.84
1
library/elasticsearch:8.17.32cc40b15dff8
bcprov-jdk18on@1.78.1
1.84
1
library/elasticsearch:8.15.0310b9fc03b06
bcprov-jdk18on@1.78.1
1.84
1
library/logstash:9.1.233eae14f0867
bcprov-jdk18on@1.81
1.84
1
library/sonarqube:10.7.0-community0842dcd4c8f8
bcprov-jdk18on@1.76
1.84
1
linuxserver/airsonic-advanced:11.1.4d286a7f55a59
bcprov-jdk18on@1.78.1
1.84
1
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
bcprov-jdk18on@1.76
1.84
1
nacos/nacos-server:v3.0.20e951a1d07bb
bcprov-jdk18on@1.79
1.84
1
nacos/nacos-server:v3.0.130a39cb0c54d
bcprov-jdk18on@1.79
1.84
1
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
bcprov-jdk18on@1.77
1.84
1
openbas/platform:2.0.5d986d80b0a75
bcprov-jdk18on@1.82
1.84
1
opensearchproject/data-prepper:2.8.057c25fa01d3c
bcprov-jdk18on@1.76
1.84
1
opensearchproject/opensearch:2.15.01963b3ece46d
bcprov-jdk15to18@1.74
bcprov-jdk18on@1.78
1.84
1.84
1
opensearchproject/opensearch:2.14.0466a49f379bb
bcprov-jdk15to18@1.75
bcprov-jdk18on@1.78
1.84
1.84
1
opensearchproject/opensearch:3.1.0474ea3fdf25d
bcprov-jdk18on@1.81
1.84
1
opensearchproject/opensearch:2.12.0645d3d9390ad
bcprov-jdk15to18@1.76
bcprov-jdk18on@1.77
1.84
1.84
1
opensearchproject/opensearch:2.19.269588c664014
bcprov-jdk15to18@1.78.1
bcprov-jdk18on@1.80
1.84
1.84
1
opensearchproject/opensearch:2.19.68690b204fe91
bcprov-jdk15to18@1.79
1.84
1
opensearchproject/opensearch:2.10.0c8f3ebd2a934
bcprov-jdk15to18@1.75
1.84
1
openzipkin/zipkin-slim:3.6.0a69e1057df36
bcprov-jdk18on@1.78.1
1.84
1
razzy10/product-service:latest702e411956db
bcprov-jdk18on@1.80
1.84
1
siakhooi/query:1.0.0f1f4b5b1b870
bcprov-jdk18on@1.80
1.84
1
sonatype/nexus3:3.58.1586060431b64
bcprov-jdk15to18@1.75
1.84
1
streamnative/private-cloud-console:v2.3.27-all91e54375e154
bcprov-jdk18on@1.79
1.84
1
structurizr/onpremises:2025.11.094b5ffb5119c8
bcprov-jdk18on@1.78.1
1.84
1
thingsboard/tb-postgres:latest2d17e4e36edc
bcprov-jdk18on@1.78.1
1.84
1
treskon/portrait:DEV-latest88e813f22347
bcprov-jdk18on@1.76
1.84
1
vespaengine/vespa:8.526.1569b160f58211
bcprov-jdk18on@1.78.1
1.84
1
wazuh/wazuh-indexer:4.14.49c344d2b1757
bcprov-jdk15to18@1.78.1
bcprov-jdk18on@1.82
1.84
1.84
1
wazuh/wazuh-indexer:4.11.1a7a2076b167e
bcprov-jdk15to18@1.78
1.84
1
wazuh/wazuh-indexer:4.14.3b149b30da686
bcprov-jdk15to18@1.79
bcprov-jdk18on@1.82
1.84
1.84
1
ghcr.io/axelixlabs/axelix:1.1.0449dc880bbfb
bcprov-jdk18on@1.81.1
1.84
1
ghcr.io/damap-org/damap-backend:5.0.0f3d0c7d35498
bcprov-jdk18on@1.78.1
1.84
1
ghcr.io/gla-rad/enav-api-gateway:latest8f4345c77dda
bcprov-jdk18on@1.81
1.84
1
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
bcprov-jdk18on@1.81
1.84
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.