CVE-2025-14813 — Vulnerability in...
CRITICAL
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
Published April 17, 2026Updated September 24, 2026Source: osv
Summary
The GOST 28147-2015 CTR mode implementation (`G3413CTRBlockCipher`) in the Legion of the Bouncy Castle BC-JAVA `bcprov` core module only increments the final byte of the counter, so the counter wraps after 255 blocks and the keystream is reused. Reusing CTR keystream allows an attacker who can observe two ciphertexts produced with the same key/IV to recover the XOR of the plaintexts, breaking confidentiality. Affects BC-JAVA from 1.59 before 1.84 (with backported fixes in 1.80.2 and 1.81.1).
Advisory Timeline
- First published April 17, 2026 (178 days ago).
- Last revised September 24, 2026 — 160 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update org.bouncycastle:bcprov-jdk15to18 to 1.84 or later<!-- Update pom.xml dependency version to 1.84 for org.bouncycastle:bcprov-jdk15to18 -->
Maven
Update org.bouncycastle:bcprov-jdk18on to 1.80.2 or later<!-- Update pom.xml dependency version to 1.80.2 for org.bouncycastle:bcprov-jdk18on -->
Maven
Update org.bouncycastle:bcprov-jdk18on to 1.81.1 or later<!-- Update pom.xml dependency version to 1.81.1 for org.bouncycastle:bcprov-jdk18on -->
Maven
Update org.bouncycastle:bcprov-debug-jdk18on to 1.84 or later<!-- Update pom.xml dependency version to 1.84 for org.bouncycastle:bcprov-debug-jdk18on -->
Maven
Update org.bouncycastle:bcprov-debug-jdk14 to 1.84 or later<!-- Update pom.xml dependency version to 1.84 for org.bouncycastle:bcprov-debug-jdk14 -->
Maven
Update org.bouncycastle:bcprov-jdk14 to 1.84 or later<!-- Update pom.xml dependency version to 1.84 for org.bouncycastle:bcprov-jdk14 -->
Maven
Update org.bouncycastle:bcprov-jdk18on to 1.84 or later<!-- Update pom.xml dependency version to 1.84 for org.bouncycastle:bcprov-jdk18on -->
Maven
Update org.bouncycastle:bcprov-debug-jdk15to18 to 1.84 or later<!-- Update pom.xml dependency version to 1.84 for org.bouncycastle:bcprov-debug-jdk15to18 -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (26)
Affects 1 ecosystem: maven (14).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.bouncycastle:bcprov-ext-debug-jdk14 | maven | 1.60, 1.68, 1.69, 1.70 (+4 more) | Range-based data available |
| org.bouncycastle:bcprov-jdk15to18 | maven | 1.82, 1.83 | 1.84 |
| org.bouncycastle:bcprov-ext-debug-jdk15to18 | maven | 1.68, 1.69, 1.70, 1.71 (+6 more) | Range-based data available |
| org.bouncycastle:bcprov-debug-jdk15to18 | maven | 1.64, 1.68, 1.69, 1.70 (+10 more) | Range-based data available |
| org.bouncycastle:bcprov-jdk18on | maven | 1.71, 1.71.1, 1.72, 1.73 (+8 more) | 1.80.2 |
| org.bouncycastle:bcprov-jdk15on | maven | All versions | Range-based data available |
| org.bouncycastle:bcprov-jdk14 | maven | 1.59, 1.60, 1.61, 1.62 (+18 more) | Range-based data available |
| org.bouncycastle:bcprov-jdk18on | maven | 1.81, 1.81.0 | 1.81.1 |
| org.bouncycastle:bcprov-debug-jdk15on | maven | All versions | Range-based data available |
| org.bouncycastle:bcprov-debug-jdk15to18 | maven | 1.81.0 | No fix available |
| org.bouncycastle:bcprov-jdk15to18 | maven | 1.81.0 | No fix available |
| org.bouncycastle:bcprov-ext-jdk14 | maven | 1.60, 1.64, 1.65, 1.67 (+10 more) | Range-based data available |
| org.bouncycastle:bcprov-debug-jdk18on | maven | 1.81.0 | No fix available |
| org.bouncycastle:bcprov-debug-jdk18on | maven | 1.82, 1.83 | 1.84 |
| org.bouncycastle:bcprov-debug-jdk14 | maven | 1.82, 1.83 | 1.84 |
| org.bouncycastle:bcprov-jdk14 | maven | 1.81.0 | No fix available |
| org.bouncycastle:bcprov-jdk15to18 | maven | 1.63, 1.64, 1.65, 1.66 (+15 more) | Range-based data available |
| org.bouncycastle:bcprov-debug-jdk14 | maven | 1.81.0 | No fix available |
| org.bouncycastle:bcprov-ext-jdk15to18 | maven | 1.64, 1.67, 1.68, 1.69 (+10 more) | Range-based data available |
| org.bouncycastle:bcprov-jdk14 | maven | 1.82, 1.83 | 1.84 |
| org.bouncycastle:bcprov-debug-jdk18on | maven | 1.71, 1.72, 1.73, 1.74 (+6 more) | Range-based data available |
| org.bouncycastle:bcprov-debug-jdk14 | maven | 1.59, 1.60, 1.64, 1.68 (+9 more) | Range-based data available |
| org.bouncycastle:bcprov-jdk18on | maven | 1.82, 1.83 | 1.84 |
| org.bouncycastle:bcprov-debug-jdk15to18 | maven | 1.82, 1.83 | 1.84 |
| org.bouncycastle:bcprov-ext-debug-jdk18on | maven | 1.71, 1.72, 1.73, 1.74 (+3 more) | Range-based data available |
| org.bouncycastle:bcprov-ext-jdk18on | maven | 1.71, 1.72, 1.73, 1.74 (+5 more) | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-323
- CWE-327Use of a Broken or Risky Cryptographic AlgorithmMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-14813ADVISORY
- https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871fWEB
- https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3WEB
- https://access.redhat.com/errata/RHSA-2026:11720WEB
- https://access.redhat.com/errata/RHSA-2026:60248WEB
- https://access.redhat.com/errata/RHSA-2026:60249WEB
- https://access.redhat.com/errata/RHSA-2026:60250WEB
- https://access.redhat.com/errata/RHSA-2026:60251WEB
- https://access.redhat.com/errata/RHSA-2026:60252WEB
- https://access.redhat.com/errata/RHSA-2026:60254WEB
- https://access.redhat.com/errata/RHSA-2026:60256WEB
- https://access.redhat.com/errata/RHSA-2026:60259WEB
- https://access.redhat.com/errata/RHSA-2026:66488WEB
- https://access.redhat.com/security/cve/CVE-2025-14813WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2458640WEB
- https://github.com/bcgit/bc-javaPACKAGE
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813WEB
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.jsonWEB
- https://access.redhat.com/errata/RHSA-2026:11721WEB
- https://access.redhat.com/errata/RHSA-2026:13631WEB
- https://access.redhat.com/errata/RHSA-2026:14272WEB
- https://access.redhat.com/errata/RHSA-2026:14276WEB
- https://access.redhat.com/errata/RHSA-2026:17668WEB
- https://access.redhat.com/errata/RHSA-2026:18054WEB
- https://access.redhat.com/errata/RHSA-2026:18055WEB
- https://access.redhat.com/errata/RHSA-2026:18059WEB
- https://access.redhat.com/errata/RHSA-2026:21772WEB
- https://access.redhat.com/errata/RHSA-2026:24977WEB
- https://access.redhat.com/errata/RHSA-2026:53644WEB
- https://access.redhat.com/errata/RHSA-2026:53645WEB
- https://access.redhat.com/errata/RHSA-2026:53646WEB
- https://access.redhat.com/errata/RHSA-2026:53806WEB
- https://access.redhat.com/errata/RHSA-2026:60239WEB
- https://access.redhat.com/errata/RHSA-2026:60246WEB
- https://access.redhat.com/errata/RHSA-2026:60247WEB
Frequently Asked Questions
- What is CVE-2025-14813?
- Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 7.5/10).
- How do I check if my project is affected by CVE-2025-14813?
- CVE-2025-14813 affects org.bouncycastle:bcprov-ext-debug-jdk14, org.bouncycastle:bcprov-jdk15to18 and org.bouncycastle:bcprov-ext-debug-jdk15to18 (and 11 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-14813 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
7.5
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-574f-3g2m-x479
Related CVEs
- CVE-2026-107726CRITICAL
Hazelcast allows arbitrary member memory access by low-privileged client
- CVE-2026-8763CRITICAL
Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI
- CVE-2026-3505HIGH
Bouncy Castle Uncontrolled Resource Consumption vulnerability
- CVE-2026-5598HIGH
Bouncy Castle Has Covert Timing Channel Vulnerability
- CVE-2026-13506HIGH
Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard
- CVE-2024-29857MEDIUM
Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
- CVE-2024-30172MEDIUM
Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
- CVE-2024-30171MEDIUM
Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies