Vulnerability · Published Apr 15, 2026 · Assigned by bcorg
CVE-2025-14813GOSTCTR implementation unable to process more than 255 blocks correctly
High 7.5
In plain English
A high-severity broken cryptography in BC-JAVA from Legion of the Bouncy Castle Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 74.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.bouncycastle:bcprov-debug-jdk14 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-debug-jdk14 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-debug-jdk14 | 1.84 | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-debug-jdk15on | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-debug-jdk15to18 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-debug-jdk15to18 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-debug-jdk15to18 | 1.84 | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-debug-jdk18on | 1.84 | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-debug-jdk18on | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-debug-jdk18on | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-ext-debug-jdk14 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-ext-debug-jdk15to18 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-ext-debug-jdk18on | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-ext-jdk14 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-ext-jdk15to18 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-ext-jdk18on | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-jdk14 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-jdk14 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-jdk14 | 1.84 | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-jdk15on | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-jdk15to18 | 1.84 | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-jdk15to18 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-jdk15to18 | no fix listed | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-jdk18on | 1.81.1 | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-jdk18on | 1.80.2 | GHSA-574f-3g2m-x479 |
| Maven | org.bouncycastle:bcprov-jdk18on | 1.84 | GHSA-574f-3g2m-x479 |
| Ubuntu:25.10 | bouncycastle | no fix listed | UBUNTU-CVE-2025-14813 |
| Ubuntu:26.04:LTS | bouncycastle | no fix listed | UBUNTU-CVE-2025-14813 |
| Ubuntu:26.10 | bouncycastle | no fix listed | UBUNTU-CVE-2025-14813 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Legion of the Bouncy Castle Inc. | BC-JAVA | 1.59 – before 1.80.21.81 – before 1.81.11.82 – before 1.84 |
Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813 vendor-advisory
- https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f patch
- https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3 patch
- https://access.redhat.com/security/cve/CVE-2025-14813 vdb-entry, x_refsource_REDHAT
- RHBZ#2458640 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53645 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18054 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53646 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18055 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60247 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60249 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60248 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60239 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60251 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60246 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60250 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60252 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60259 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60254 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60256 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14276 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14272 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66488 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13631 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18059 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24977 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21772 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17668 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11720 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11721 vendor-advisory, x_refsource_REDHAT