StackRadar

CVE-2026-5588

High

Advisory

Published 15 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
269
of 17,781 indexed, latest versions
Container images
288
deployed by those charts
Fix available
3 of 4
affected packages

Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

Carried by container images the latest versions of 269 of 17,781 indexed charts deploy, on 288 images.

Affected packageAffected versionsFixed inImages
bouncycastledeb1.61-1no fix listed1
bcpkix-jdk15onmaven1.50, 1.53, 1.54, 1.55+13 more1.84187
bcpkix-jdk18onmaven1.71, 1.72, 1.73, 1.74+11 more1.8495
bcpkix-jdk15to18maven1.65, 1.72, 1.74, 1.75+6 more1.8418
OSV records
UBUNTU-CVE-2026-5588GHSA-wg6q-6289-32hp

Charts affected

269 by stars
ChartLatestAffected imagesRadar Score
datawolfncsaVerified publisher1.1.01 of 3See more

datawolf ncsa 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
ncsa/datawolf:4.7.0af6649d59150
bcpkix-jdk18on@1.72
1.84

Open the chart page →

4,989
incorencsaVerified publisher1.38.01 of 29See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
bitnamilegacy/keycloak:24.0.4cc599cbd15ff
bcpkix-jdk18on@1.77
1.84

Open the chart page →

15,369
neo4jneo4j-helm-old4.3.2-11 of 1See more

neo4j neo4j-helm-old 4.3.2-1

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
library/neo4j:4.3.2-enterprise56a9453c4064
bcpkix-jdk15on@1.68
1.84

Open the chart page →

2,640
config-server-helm-chartnotesprojectchart0.1.01 of 1See more

config-server-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
vlebediantsev/config-server-another:lateste7f20450d2ae
bcpkix-jdk15on@1.68
1.84

Open the chart page →

3,422
file-system-ms-helm-chartnotesprojectchart0.1.01 of 2See more

file-system-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
vlebediantsev/file-system-ms-final:latest10393a89b4a8
bcpkix-jdk15on@1.68
1.84

Open the chart page →

5,875
logic-ms-helm-chartnotesprojectchart0.1.01 of 2See more

logic-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
vlebediantsev/logic-ms:latestdf8bf38c535b
bcpkix-jdk15on@1.69
1.84

Open the chart page →

6,852
registration-ms-helm-chartnotesprojectchart0.1.01 of 2See more

registration-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-final:latest427af418b75e
bcpkix-jdk15on@1.64
1.84

Open the chart page →

5,916
user-data-ms-helm-chartnotesprojectchart0.1.01 of 2See more

user-data-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
bcpkix-jdk15on@1.68
1.84

Open the chart page →

5,873
my-bloody-jenkinsodavid0.1.2181 of 1See more

my-bloody-jenkins odavid 0.1.218

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
bcpkix-jdk18on@1.78.1
1.84

Open the chart page →

5,826
hive-metastoreolehrgfVerified publisher0.1.01 of 1See more

hive-metastore olehrgf 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
bcpkix-jdk15on@1.60
1.84

Open the chart page →

8,540
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
bcpkix-jdk18on@1.75
1.84

Open the chart page →

9,005
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
bcpkix-jdk15on@1.69
1.84

Open the chart page →

6,037
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
vespaengine/vespa:8.526.1569b160f58211
bcpkix-jdk18on@1.78.1
1.84

Open the chart page →

6,338
onosopencord3.0.21 of 1See more

onos opencord 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
onosproject/onos:2.2.144914a8d4b3f
bcpkix-jdk15on@1.59
1.84

Open the chart page →

12,927
voltha-infraopencord2.14.01 of 10See more

voltha-infra opencord 2.14.0

1 of the 10 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
voltha/voltha-onos:5.1.8e038acb950d3
bcpkix-jdk15on@1.66
1.84

Open the chart page →

41,044
smsf-configurationopenshift1.0.41 of 1See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
gurolakman/smsf-configuration:1.0.49abb3882bcbd
bcpkix-jdk15on@1.68
1.84

Open the chart page →

13,607
smsf-dispatcheropenshift1.0.41 of 1See more

smsf-dispatcher openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
bcpkix-jdk15on@1.50
1.84

Open the chart page →

11,738
smsf-momtopenshift1.0.41 of 1See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
gurolakman/smsf-momt:1.0.4ce23b20a8a17
bcpkix-jdk15on@1.50
1.84

Open the chart page →

13,568
smsf-registrationopenshift1.0.41 of 1See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
gurolakman/smsf-registration:1.0.4b22e746edd5d
bcpkix-jdk15on@1.50
1.84

Open the chart page →

13,551
ussigw-configurationopenshift1.0.41 of 1See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
bcpkix-jdk15on@1.68
1.84

Open the chart page →

13,455
ussigw-coreopenshift1.0.41 of 1See more

ussigw-core openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
gurolakman/ussigw-core:1.0.48739565c3ea2
bcpkix-jdk15on@1.50
1.84

Open the chart page →

13,100
dfdeweyosdfir-infrastructureVerified publisher1.0.01 of 3See more

dfdewey osdfir-infrastructure 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.12.0645d3d9390ad
bcpkix-jdk15to18@1.76
bcpkix-jdk18on@1.74
1.84
1.84

Open the chart page →

1,190
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
opensearchproject/opensearch:3.1.0474ea3fdf25d
bcpkix-jdk18on@1.81
1.84

Open the chart page →

71,208
timesketchosdfir-infrastructureVerified publisher1.0.81 of 6See more

timesketch osdfir-infrastructure 1.0.8

1 of the 6 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.14.0466a49f379bb
bcpkix-jdk15to18@1.78
bcpkix-jdk18on@1.74
1.84
1.84

Open the chart page →

1,753
keycloakpascaliskeVerified publisher0.2.01 of 1See more

keycloak pascaliske 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.0.74388e2379b7e
bcpkix-jdk18on@1.78.1
1.84

Open the chart page →

2,097
helloworldpauls-helm-charts2.0.01 of 1See more

helloworld pauls-helm-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
paulczar/spring-helloworld:latestc7140cecd5f7
bcpkix-jdk15on@1.60
1.84

Open the chart page →

5,596
apache-knox-helmpfisterer-knox0.1.111 of 1See more

apache-knox-helm pfisterer-knox 0.1.11

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
farberg/apache-knox-docker:1.6.14b4a22487394
bcpkix-jdk15on@1.67
1.84

Open the chart page →

6,237
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
bcpkix-jdk18on@1.77
1.84

Open the chart page →

5,269
sonarquberedhat-cop0.1.131 of 1See more

sonarqube redhat-cop 0.1.13

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
library/sonarqube:10.7.0-community0842dcd4c8f8
bcpkix-jdk18on@1.76
1.84

Open the chart page →

4,203
reportportalreportportal5.7.22 of 8See more

reportportal reportportal 5.7.2

2 of the 8 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
reportportal/service-api:5.7.29df41f8fb320
bcpkix-jdk15on@1.64
1.84
reportportal/service-authorization:5.7.09e73114dbd15
bcpkix-jdk15on@1.64
1.84

Open the chart page →

25,737
fmtok8s-conference-chartsalaboy0.1.41 of 6See more

fmtok8s-conference-chart salaboy 0.1.4

1 of the 6 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
ghcr.io/salaboy/fmtok8s-frontend:v0.1.103fd01b4f56e
bcpkix-jdk15on@1.68
1.84

Open the chart page →

16,101
fmtok8s-frontendsalaboy0.1.31 of 1See more

fmtok8s-frontend salaboy 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
ghcr.io/salaboy/fmtok8s-frontend:v0.1.103fd01b4f56e
bcpkix-jdk15on@1.68
1.84

Open the chart page →

8,033
keycloaksb-helm-charts0.3.01 of 2See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.0.6a93d22e13b86
bcpkix-jdk18on@1.78.1
1.84

Open the chart page →

2,590
seldon-core-oauth-gatewayseldon0.3.11 of 2See more

seldon-core-oauth-gateway seldon 0.3.1

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
seldonio/apife:0.3.1eea0d3f578ca
bcpkix-jdk15on@1.59
1.84

Open the chart page →

8,098
guacamolesergiotocaliniVerified publisher1.0.01 of 2See more

guacamole sergiotocalini 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
guacamole/guacamole:1.5.50f62f6d17ab3
bcpkix-jdk15on@1.70
1.84

Open the chart page →

5,456
shenyushenyu0.6.31 of 2See more

shenyu shenyu 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.5.11bd5756f6273
bcpkix-jdk15on@1.69
1.84

Open the chart page →

8,804
shenyushenyu-helm-chart-test2.4.271 of 2See more

shenyu shenyu-helm-chart-test 2.4.27

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
bcpkix-jdk15on@1.64
1.84

Open the chart page →

12,513
keycloaksikalabs0.1.01 of 1See more

keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.3.36a7217a100bd
bcpkix-jdk18on@1.81
1.84

Open the chart page →

1,690
simple-keycloaksikalabs0.1.01 of 1See more

simple-keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.18830f76112b6
bcpkix-jdk15on@1.70
1.84

Open the chart page →

6,443
sonatype-nexus3simcube1.0.11 of 2See more

sonatype-nexus3 simcube 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
sonatype/nexus3:3.58.1586060431b64
bcpkix-jdk15to18@1.75
1.84

Open the chart page →

4,946
sistas-chatbotsistas-chatbot5.0.21 of 6See more

sistas-chatbot sistas-chatbot 5.0.2

1 of the 6 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
jhipster/jhipster-registry:latest7184525acd4d
bcpkix-jdk15on@1.64
1.84

Open the chart page →

5,856
hetzner-iroboslamdev0.0.51 of 1See more

hetzner-irobo slamdev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
slamdev/hetzner-irobo:0.0.13ca20c184c55
bcpkix-jdk15on@1.68
1.84

Open the chart page →

3,754
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
bcpkix-jdk15on@1.64
1.84

Open the chart page →

13,605
atlassian-jirasomeblackmagic3.3.21 of 1See more

atlassian-jira someblackmagic 3.3.2

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
atlassian/jira-software:8.14.037bc46cbec1a
bcpkix-jdk15on@1.55
1.84

Open the chart page →

13,079
teku-validatorstakewise4.3.21 of 2See more

teku-validator stakewise 4.3.2

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
consensys/teku:25.4.1bf6ecd2ea716
bcpkix-jdk18on@1.80
1.84

Open the chart page →

3,153
unifistartechnicaVerified publisher0.1.31 of 2See more

unifi startechnica 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
jacobalberty/unifi:v7.1.664a3616625dda
bcpkix-jdk15on@1.60
1.84

Open the chart page →

14,493
fdi-dotstatsuite-sfs-solrstatcan1.0.21 of 4See more

fdi-dotstatsuite-sfs-solr statcan 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
bcpkix-jdk15on@1.69
1.84

Open the chart page →

6,065
solrstatcan1.5.101 of 3See more

solr statcan 1.5.10

1 of the 3 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
bcpkix-jdk15on@1.69
1.84

Open the chart page →

8,806
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
bcpkix-jdk18on@1.79
1.84

Open the chart page →

1,827
wonder-mesh-netstrrl-helm2026.629.01 of 3See more

wonder-mesh-net strrl-helm 2026.629.0

1 of the 3 container images this version deploys carry CVE-2026-5588.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.009a381c715ab
bcpkix-jdk18on@1.78.1
1.84

Open the chart page →

5,063

Container images carrying it

288 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
wistefan/mvf:lateste0887302b2d8
bcpkix-jdk15on@1.68
bcpkix-jdk15to18@1.72
1.84
1.84
1
zahoriaut/zahori-process:0.1.13351f8a220ed7
bcpkix-jdk15on@1.70
1.84
1
zahoriaut/zahori-server:0.1.17b2de13916f3e
bcpkix-jdk15on@1.69
1.84
1
zammad/zammad-docker-compose:zammad-elasticsearch-4.1.0-318274d75a51fc
bcpkix-jdk15on@1.64
1.84
1
gcr.io/spinnaker-marketplace/halyard:1.32.00ee5f968d2ab
bcpkix-jdk15on@1.61
1.84
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
bcpkix-jdk15on@1.70
1.84
1
ghcr.io/damap-org/damap-backend:5.0.0f3d0c7d35498
bcpkix-jdk18on@1.78.1
1.84
1
ghcr.io/data-fair/elasticsearch:7.17.1aa45adaf59a7
bcpkix-jdk15on@1.64
1.84
1
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
bcpkix-jdk15on@1.59
1.84
1
ghcr.io/fleeksoft/hbase/hdfs:3.3.3.2ac62269785ac
bcpkix-jdk15on@1.60
1.84
1
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
bcpkix-jdk18on@1.80
1.84
1
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
bcpkix-jdk18on@1.81.1
1.84
1
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
bcpkix-jdk15to18@1.65
1.84
1
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
bcpkix-jdk15on@1.60
1.84
1
ghcr.io/navikt/mock-oauth2-server:2.1.1065d4ed47ce09
bcpkix-jdk18on@1.78.1
1.84
1
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
bcpkix-jdk15on@1.69
1.84
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
bcpkix-jdk15on@1.64
bcpkix-jdk18on@1.71
1.84
1.84
1
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
bcpkix-jdk18on@1.82
1.84
1
ghcr.io/wundergraph/cosmo/keycloak:0.13.0b37408461b9b
bcpkix-jdk18on@1.82
1.84
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
bcpkix-jdk15on@1.68
1.84
1
quay.io/fiware/contract-management:3.3.122bcfcf874451
bcpkix-jdk18on@1.81
1.84
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
bcpkix-jdk15to18@1.72
1.84
1
quay.io/keycloak/keycloak:26.009a381c715ab
bcpkix-jdk18on@1.78.1
1.84
1
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
bcpkix-jdk15on@1.68
1.84
1
quay.io/keycloak/keycloak:26.0.74388e2379b7e
bcpkix-jdk18on@1.78.1
1.84
1
quay.io/keycloak/keycloak:24.0.34d6f22991266
bcpkix-jdk18on@1.77
1.84
1
quay.io/keycloak/keycloak:23.0.34f72a5b0c076
bcpkix-jdk18on@1.74
1.84
1
quay.io/keycloak/keycloak:26.3.36a7217a100bd
bcpkix-jdk18on@1.81
1.84
1
quay.io/keycloak/keycloak:20.0.18830f76112b6
bcpkix-jdk15on@1.70
1.84
1
quay.io/keycloak/keycloak:26.5.68d44614c7479
bcpkix-jdk18on@1.82
1.84
1
quay.io/keycloak/keycloak:26.49409c59bdfb6
bcpkix-jdk18on@1.82
1.84
1
quay.io/keycloak/keycloak:26.0.6a93d22e13b86
bcpkix-jdk18on@1.78.1
1.84
1
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
bcpkix-jdk15on@1.70
1.84
1
quay.io/keycloak/keycloak-operator:20.0.2b1710745fa64
bcpkix-jdk15on@1.70
1.84
1
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
bcpkix-jdk15to18@1.83
1.84
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
bcpkix-jdk15on@1.69
1.84
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
bcpkix-jdk18on@1.81
1.84
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
bcpkix-jdk18on@1.78.1
1.84
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.