StackRadar

CVE-2026-0636

Medium

Advisory

Published 15 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.005
43rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
124
of 17,781 indexed, latest versions
Container images
131
deployed by those charts
Fix available
2 of 3
affected packages

Bouncy Castle has an LDAP injection

Carried by container images the latest versions of 124 of 17,781 indexed charts deploy, on 131 images.

Affected packageAffected versionsFixed inImages
bcprov-jdk18onmaven1.74, 1.75, 1.76, 1.77+9 more1.84124
bcprov-jdk15to18maven1.74, 1.75, 1.76, 1.78+4 more1.8415
bouncycastledeb1.61-1no fix listed1
OSV records
GHSA-c3fc-8qff-9hwxUBUNTU-CVE-2026-0636

Charts affected

124 by stars
ChartLatestAffected imagesRadar Score
inbox-serverappscodeVerified publisher2025.12.251 of 1See more

inbox-server appscode 2025.12.25

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:postgres-latest536358d7b17e
bcprov-jdk18on@1.82
1.84

Open the chart page →

3,963
inbox-server-distributedappscodeVerified publisher2025.12.251 of 4See more

inbox-server-distributed appscode 2025.12.25

1 of the 4 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:latest536358d7b17e
bcprov-jdk18on@1.82
1.84

Open the chart page →

15,573
arlas-aiasarlas-stackVerified publisher28.8.02 of 22See more

arlas-aias arlas-stack 28.8.0

2 of the 22 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
bcprov-jdk18on@1.78.1
1.84
bitnamilegacy/keycloak:26.3.3-debian-12-r0da3df0976a9f
bcprov-jdk18on@1.81
1.84

Open the chart page →

40,238
keycloakbarravarVerified publisher1.0.41 of 1See more

keycloak barravar 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:24.0.34d6f22991266
bcprov-jdk18on@1.77
1.84

Open the chart page →

2,381
bluerange-serverbluerangeOfficialVerified publisher1.3.11 of 1See more

bluerange-server bluerange 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
bluerange/bluerange:26.1.307c8f73b55df
bcprov-jdk18on@1.79
1.84

Open the chart page →

1,816
jenkinsbook-k8sinfra-v25.1.121 of 2See more

jenkins book-k8sinfra-v2 5.1.12

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
jenkins/jenkins:2.440.3-jdk17de4fea113221
bcprov-jdk18on@1.77
1.84

Open the chart page →

8,323
camellia-redis-proxycamellia-redis-proxy1.4.01 of 2See more

camellia-redis-proxy camellia-redis-proxy 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
48n6e/camellia-redis-proxy:1.4.0-jdk-21-0.0.1a6ed886fddfc
bcprov-jdk18on@1.83
1.84

Open the chart page →

8,001
opensearch-singlenodecaptnbpVerified publisher1.0.91 of 2See more

opensearch-singlenode captnbp 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.15.01963b3ece46d
bcprov-jdk15to18@1.74
bcprov-jdk18on@1.78
1.84
1.84

Open the chart page →

1,073
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
bcprov-jdk18on@1.82
1.84

Open the chart page →

7,168
gitea-jenkinsclusterfactory0.1.11 of 5See more

gitea-jenkins clusterfactory 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
bcprov-jdk18on@1.82
1.84

Open the chart page →

5,238
nifi-registryd4nVerified publisher1.0.01 of 2See more

nifi-registry d4n 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

5,398
damap-chartdamapVerified publisher0.3.02 of 5See more

damap-chart damap 0.3.0

2 of the 5 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
ghcr.io/damap-org/damap-backend:5.0.0f3d0c7d35498
bcprov-jdk18on@1.78.1
1.84
quay.io/keycloak/keycloak:26.49409c59bdfb6
bcprov-jdk18on@1.82
1.84

Open the chart page →

13,936
dara-chartsdara-charts0.1.01 of 2See more

dara-charts dara-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
razzy10/product-service:latest702e411956db
bcprov-jdk18on@1.80
1.84

Open the chart page →

3,547
deployhubdeployhubVerified publisher10.0.4151 of 11See more

deployhub deployhub 10.0.415

1 of the 11 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/deployhub/ms-ui:svccat-v11.0.815-g717581f5dedbc31e6f
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

11,160
entrypoint-balancereclipse-aeriosVerified publisher1.3.01 of 1See more

entrypoint-balancer eclipse-aerios 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
eclipseaerios/entrypoint-balancer:1.3.043cd999a008d
bcprov-jdk18on@1.77
1.84

Open the chart page →

2,512
unifiegebackVerified publisher2.1.61 of 1See more

unifi egeback 2.1.6

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
jacobalberty/unifi:v10.0.162896c0ab82d33
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

7,268
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
library/logstash:9.1.233eae14f0867
bcprov-jdk18on@1.81
1.84

Open the chart page →

2,942
fddb-exporterfddb-exporterVerified publisher2.4.31 of 1See more

fddb-exporter fddb-exporter 2.4.3

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
ghcr.io/itobey/fddb-exporter:2.4.1a824933e0f87
bcprov-jdk18on@1.81.1
1.84

Open the chart page →

467
fibfibonacci-cluster-appsVerified publisher1.0.03 of 5See more

fib fibonacci-cluster-apps 1.0.0

3 of the 5 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
golenski/fibonacci-msg-relay:1.0.0c863dcb0c513
bcprov-jdk18on@1.77
1.84
golenski/fibonacci-task-manager:2.0.03a2b36df247b
bcprov-jdk18on@1.77
1.84
golenski/fibonacci-worker:2.0.0954caf4aaf6a
bcprov-jdk18on@1.77
1.84

Open the chart page →

16,927
infrafibonacci-cluster-infraVerified publisher1.0.01 of 4See more

infra fibonacci-cluster-infra 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
apache/activemq-artemis:2.37.0bae523439ee3
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

12,454
consent-facadefiware0.1.11 of 1See more

consent-facade fiware 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/seamware/consent-facade:0.0.14be844c750c7e
bcprov-jdk18on@1.81
1.84

Open the chart page →

2,475
contract-managementfiware3.5.361 of 1See more

contract-management fiware 3.5.36

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/fiware/contract-management:3.3.122bcfcf874451
bcprov-jdk18on@1.81
1.84

Open the chart page →

2,411
dss-validation-servicefiware0.0.191 of 1See more

dss-validation-service fiware 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

4,536
mod-data-exportfolio-org0.1.401 of 1See more

mod-data-export folio-org 0.1.40

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
folioci/mod-data-export:latest0cc86bf09755
bcprov-jdk18on@1.81
1.84

Open the chart page →

1,393
mod-data-export-workerfolio-org0.1.151 of 1See more

mod-data-export-worker folio-org 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
folioci/mod-data-export-worker:latest1ad1811c9b37
bcprov-jdk18on@1.81
1.84

Open the chart page →

1,214
mod-entities-linksfolio-org0.1.11 of 1See more

mod-entities-links folio-org 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
folioci/mod-entities-links:latest3e2412815c0f
bcprov-jdk18on@1.81
1.84

Open the chart page →

285
mod-searchfolio-org0.1.351 of 1See more

mod-search folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
folioci/mod-search:latest44d7ee9acdf6
bcprov-jdk18on@1.81
1.84

Open the chart page →

1,531
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
bcprov-jdk15to18@1.78.1
bcprov-jdk18on@1.78.1
1.84
1.84

Open the chart page →

49,025
gridgain9gridgainVerified publisher1.1.101 of 2See more

gridgain9 gridgain 1.1.10

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
gridgain/gridgain9:9.1.1895018390077b
bcprov-jdk18on@1.83
1.84

Open the chart page →

3,199
druidhelmforgeVerified publisher1.3.61 of 4See more

druid helmforge 1.3.6

1 of the 4 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
bcprov-jdk18on@1.82
1.84

Open the chart page →

8,541
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
openbas/platform:2.0.5d986d80b0a75
bcprov-jdk18on@1.82
1.84

Open the chart page →

25,017
nifi-registryimprowisedVerified publisher1.0.01 of 2See more

nifi-registry improwised 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
apache/nifi-registry:1.27.063b8e3e40742
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

5,320
fpga-operatorinaccelVerified publisher2.8.21 of 7See more

fpga-operator inaccel 2.8.2

1 of the 7 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
inaccel/coral:2.18c53744ed70b
bcprov-jdk18on@1.77
1.84

Open the chart page →

5,759
daveit-at-mOfficialVerified publisher0.2.155 of 11See more

dave it-at-m 0.2.15

5 of the 11 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
bcprov-jdk18on@1.78.1
1.84
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal:10.0.0cbff8141302f
bcprov-jdk18on@1.80.2
1.84
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
bcprov-jdk18on@1.81
1.84
ghcr.io/it-at-m/dave-frontend/dave-frontend:10.0.0a49fdb8d6f1b
bcprov-jdk18on@1.80.2
1.84
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal:10.0.0d352df1b94b6
bcprov-jdk18on@1.80.2
1.84

Open the chart page →

15,089
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.1.4044a457e0498
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

45,239
unifik8sonlabVerified publisher0.3.71 of 1See more

unifi k8sonlab 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
jacobalberty/unifi:v10.0.162896c0ab82d33
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

7,268
fpga-operatorkubesphere-stable2.7.41 of 7See more

fpga-operator kubesphere-stable 2.7.4

1 of the 7 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
inaccel/coral:2.18c53744ed70b
bcprov-jdk18on@1.77
1.84

Open the chart page →

5,759
mock-oidclabs64io-helm-chartsVerified publisher0.1.01 of 1See more

mock-oidc labs64io-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
ghcr.io/navikt/mock-oauth2-server:2.1.1065d4ed47ce09
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

703
elasticmicroboxlabs0.3.01 of 1See more

elastic microboxlabs 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
library/elasticsearch:8.17.32cc40b15dff8
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

4,257
microcks-operatormicrocksVerified publisher0.0.111 of 1See more

microcks-operator microcks 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
bcprov-jdk15to18@1.83
1.84

Open the chart page →

1,261
resource-processormicroservices-learningVerified publisher1.2.01 of 1See more

resource-processor microservices-learning 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
bcprov-jdk18on@1.76
1.84

Open the chart page →

3,683
keycloakmt1905021.4.61 of 3See more

keycloak mt190502 1.4.6

1 of the 3 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.5.68d44614c7479
bcprov-jdk18on@1.82
1.84

Open the chart page →

2,901
myappmyapp-helm-charts0.4.01 of 1See more

myapp myapp-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
adityaprasadpathak/myapp:3.07e3b9777362c
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

2,141
nacosnacos-yunyeVerified publisher1.0.31 of 1See more

nacos nacos-yunye 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.130a39cb0c54d
bcprov-jdk18on@1.79
1.84

Open the chart page →

1,783
incorencsaVerified publisher1.38.01 of 29See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
bitnamilegacy/keycloak:24.0.4cc599cbd15ff
bcprov-jdk18on@1.77
1.84

Open the chart page →

15,369
my-bloody-jenkinsodavid0.1.2181 of 1See more

my-bloody-jenkins odavid 0.1.218

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
bcprov-jdk18on@1.77
1.84

Open the chart page →

5,826
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
bcprov-jdk18on@1.75
1.84

Open the chart page →

9,005
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
bcprov-jdk18on@1.74
1.84

Open the chart page →

6,037
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
vespaengine/vespa:8.526.1569b160f58211
bcprov-jdk18on@1.78.1
1.84

Open the chart page →

6,338
dfdeweyosdfir-infrastructureVerified publisher1.0.01 of 3See more

dfdewey osdfir-infrastructure 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-0636.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.12.0645d3d9390ad
bcprov-jdk15to18@1.76
bcprov-jdk18on@1.77
1.84
1.84

Open the chart page →

1,190

Container images carrying it

131 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
bcprov-jdk18on@1.81
1.84
1
ghcr.io/gla-rad/enav-eureka:latest05002092c621
bcprov-jdk18on@1.81
1.84
1
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
bcprov-jdk18on@1.81
1.84
1
ghcr.io/gla-rad/enav-vdes-controller:latestc4c52955814f
bcprov-jdk18on@1.81
1.84
1
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
bcprov-jdk18on@1.80
1.84
1
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal:10.0.0cbff8141302f
bcprov-jdk18on@1.80.2
1.84
1
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
bcprov-jdk18on@1.81
1.84
1
ghcr.io/it-at-m/dave-frontend/dave-frontend:10.0.0a49fdb8d6f1b
bcprov-jdk18on@1.80.2
1.84
1
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal:10.0.0d352df1b94b6
bcprov-jdk18on@1.80.2
1.84
1
ghcr.io/itobey/fddb-exporter:2.4.1a824933e0f87
bcprov-jdk18on@1.81.1
1.84
1
ghcr.io/navikt/mock-oauth2-server:2.1.1065d4ed47ce09
bcprov-jdk18on@1.78.1
1.84
1
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
bcprov-jdk18on@1.78.1
1.84
1
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure:3.0.67fb9c70e96a4
bcprov-jdk18on@1.78.1
1.84
1
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
bcprov-jdk18on@1.82
1.84
1
ghcr.io/wundergraph/cosmo/keycloak:0.13.0b37408461b9b
bcprov-jdk18on@1.82
1.84
1
quay.io/deployhub/ms-ui:svccat-v11.0.815-g717581f5dedbc31e6f
bcprov-jdk18on@1.78.1
1.84
1
quay.io/fiware/contract-management:3.3.122bcfcf874451
bcprov-jdk18on@1.81
1.84
1
quay.io/keycloak/keycloak:26.009a381c715ab
bcprov-jdk18on@1.78.1
1.84
1
quay.io/keycloak/keycloak:26.0.74388e2379b7e
bcprov-jdk18on@1.78.1
1.84
1
quay.io/keycloak/keycloak:24.0.34d6f22991266
bcprov-jdk18on@1.77
1.84
1
quay.io/keycloak/keycloak:23.0.34f72a5b0c076
bcprov-jdk18on@1.74
1.84
1
quay.io/keycloak/keycloak:26.3.36a7217a100bd
bcprov-jdk18on@1.81
1.84
1
quay.io/keycloak/keycloak:26.5.68d44614c7479
bcprov-jdk18on@1.82
1.84
1
quay.io/keycloak/keycloak:26.49409c59bdfb6
bcprov-jdk18on@1.82
1.84
1
quay.io/keycloak/keycloak:26.0.6a93d22e13b86
bcprov-jdk18on@1.78.1
1.84
1
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
bcprov-jdk15to18@1.83
1.84
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
bcprov-jdk18on@1.74
1.84
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
bcprov-jdk18on@1.74
1.84
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
bcprov-jdk18on@1.74
1.84
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
bcprov-jdk18on@1.81
1.84
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
bcprov-jdk18on@1.78.1
1.84
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.