Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Opensearch 3.9.0
Describe the issue: The following High vulnerabilies are still present in Bouncy Castle Provider - FIPS 2.1.3 in Opensearch 3.9.0.
CVE-2026-59640
CVE-2026-59638
Configuration:
Relevant Logs or Screenshots:
@mohan-rh7, Thanks for reporting this. The version 2.1.3 refers to the core bc-fips provider, which was intentionally kept at that version as per PR #23081. These CVEs affect separately versioned companion artifacts: CVE-2026-59638 affects bctls-fips before 2.1.24, and CVE-2026-59640 affects bcpg-fips before 2.1.13.
bctls-fips was upgraded to 2.1.24 and bcpg-fips to 2.1.13 in PR #23081, which was backported to the 3.9 branch.