Vulnerability · Published Apr 15, 2026 · Assigned by bcorg

CVE-2025-14813GOSTCTR implementation unable to process more than 255 blocks correctly

High 7.5

In plain English

A high-severity broken cryptography in BC-JAVA from Legion of the Bouncy Castle Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 74.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.bouncycastle:bcprov-debug-jdk14	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-debug-jdk14	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-debug-jdk14	1.84	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-debug-jdk15on	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-debug-jdk15to18	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-debug-jdk15to18	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-debug-jdk15to18	1.84	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-debug-jdk18on	1.84	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-debug-jdk18on	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-debug-jdk18on	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-ext-debug-jdk14	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-ext-debug-jdk15to18	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-ext-debug-jdk18on	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-ext-jdk14	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-ext-jdk15to18	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-ext-jdk18on	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-jdk14	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-jdk14	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-jdk14	1.84	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-jdk15on	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-jdk15to18	1.84	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-jdk15to18	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-jdk15to18	no fix listed	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-jdk18on	1.81.1	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-jdk18on	1.80.2	GHSA-574f-3g2m-x479
Maven	org.bouncycastle:bcprov-jdk18on	1.84	GHSA-574f-3g2m-x479
Ubuntu:25.10	bouncycastle	no fix listed	UBUNTU-CVE-2025-14813
Ubuntu:26.04:LTS	bouncycastle	no fix listed	UBUNTU-CVE-2025-14813
Ubuntu:26.10	bouncycastle	no fix listed	UBUNTU-CVE-2025-14813

Affected products (as reported)

Vendor	Product	Versions
Legion of the Bouncy Castle Inc.	BC-JAVA	1.59 – before 1.80.21.81 – before 1.81.11.82 – before 1.84

Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813 vendor-advisory
https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f patch
https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3 patch
https://access.redhat.com/security/cve/CVE-2025-14813 vdb-entry, x_refsource_REDHAT
RHBZ#2458640 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53645 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:18054 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53646 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:18055 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60247 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60249 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60248 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60239 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60251 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60246 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60250 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60252 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60259 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60254 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60256 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14276 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14272 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66488 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13631 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:18059 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24977 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21772 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17668 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11720 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11721 vendor-advisory, x_refsource_REDHAT