Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-14813: Bouncy Castle Java library may mishandle large data blocks

CVE-2025-14813 · published 5 months ago

Summary

The Bouncy Castle Java cryptography library (bcprov) can incorrectly process data when more than 255 blocks are encrypted with the GOSTCTR algorithm. This could lead to corrupted encrypted data or failed decryption, affecting any application that relies on this library for secure communications. Update to the latest version of the library to resolve the issue.

What to do

Update bouncycastle org.bouncycastle:bcprov-jdk18on to version 1.80.2.
Update bouncycastle org.bouncycastle:bcprov-jdk18on to version 1.81.1.
Update bouncycastle org.bouncycastle:bcprov-jdk18on to version 1.84.
Update bouncycastle org.bouncycastle:bcprov-jdk14 to version 1.84.
Update bouncycastle org.bouncycastle:bcprov-jdk15to18 to version 1.84.
Update bouncycastle org.bouncycastle:bcprov-debug-jdk15to18 to version 1.84.
Update bouncycastle org.bouncycastle:bcprov-debug-jdk18on to version 1.84.
Update bouncycastle org.bouncycastle:bcprov-debug-jdk14 to version 1.84.
Update root io.root.org.bouncycastle:bcprov-jdk18on to version 1.75-root.io.5.
Update bouncycastle org.bouncycastle:bcprov-jdk18on to version 1.75-aikido.5.
Update root io.root.org.bouncycastle:bcprov-jdk18on to version 1.77-root.io.4.
Update bouncycastle org.bouncycastle:bcprov-jdk18on to version 1.77-aikido.4.
Update root io.root.org.bouncycastle:bcprov-jdk18on to version 1.83-root.io.5.
Update bouncycastle org.bouncycastle:bcprov-jdk18on to version 1.83-aikido.5.
Update org.bouncycastle:bcprov-jdk18on to version 1.77-aikido.4.
Update io.root.org.bouncycastle:bcprov-jdk18on to version 1.77-root.io.4.
Update org.bouncycastle:bcprov-jdk15to18 to version 1.68-aikido.1.
Update io.root.org.bouncycastle:bcprov-jdk15to18 to version 1.68-root.io.1.
Update org.bouncycastle:bcprov-jdk18on to version 1.80.2.
Update org.bouncycastle:bcprov-jdk18on to version 1.81.1.
Update org.bouncycastle:bcprov-jdk14 to version 1.84.
Update org.bouncycastle:bcprov-jdk15to18 to version 1.84.
Update org.bouncycastle:bcprov-jdk18on to version 1.84.
Update org.bouncycastle:bcprov-debug-jdk14 to version 1.84.
Update org.bouncycastle:bcprov-debug-jdk15to18 to version 1.84.
Update org.bouncycastle:bcprov-debug-jdk18on to version 1.84.
Update org.bouncycastle:bcprov-jdk18on to version 1.80-aikido.12.
Update io.root.org.bouncycastle:bcprov-jdk18on to version 1.80-root.io.12.
Update legion of the bouncy castle inc. bc-java to version 1.80.2 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	bouncycastle	org.bouncycastle:bcprov-jdk18on	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.80.2
maven	bouncycastle	org.bouncycastle:bcprov-jdk14	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.84
maven	bouncycastle	org.bouncycastle:bcprov-jdk15to18	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.84
maven	bouncycastle	org.bouncycastle:bcprov-debug-jdk15to18	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.84
maven	bouncycastle	org.bouncycastle:bcprov-debug-jdk18on	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.84
maven	bouncycastle	org.bouncycastle:bcprov-debug-jdk14	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.84
maven	bouncycastle	org.bouncycastle:bcprov-ext-jdk18on	>= 1.59, <= 1.78.1
maven	bouncycastle	org.bouncycastle:bcprov-ext-jdk15to18	>= 1.59, <= 1.78.1
maven	bouncycastle	org.bouncycastle:bcprov-ext-debug-jdk15to18	>= 1.59, <= 1.77
maven	bouncycastle	org.bouncycastle:bcprov-ext-debug-jdk18on	>= 1.59, <= 1.77
maven	bouncycastle	org.bouncycastle:bcprov-ext-debug-jdk14	>= 1.59, <= 1.74
maven	bouncycastle	org.bouncycastle:bcprov-ext-jdk14	>= 1.59, <= 1.78.1
Maven	bouncycastle	org.bouncycastle:bcprov-jdk18on	>= 1.59, < 1.80.2 >= 1.81.0, < 1.81.1 >= 1.82, < 1.84 Fix: upgrade to 1.80.2
Maven	bouncycastle	org.bouncycastle:bcprov-jdk14	>= 1.82, < 1.84 Fix: upgrade to 1.84
Maven	bouncycastle	org.bouncycastle:bcprov-jdk15to18	>= 1.82, < 1.84 Fix: upgrade to 1.84
Maven	bouncycastle	org.bouncycastle:bcprov-debug-jdk15to18	>= 1.82, < 1.84 Fix: upgrade to 1.84
Maven	bouncycastle	org.bouncycastle:bcprov-debug-jdk18on	>= 1.82, < 1.84 Fix: upgrade to 1.84
Maven	bouncycastle	org.bouncycastle:bcprov-debug-jdk14	>= 1.82, < 1.84 Fix: upgrade to 1.84
–	legion of the bouncy castle inc.	bc-java	< 1.80.2
Root:Maven	root	io.root.org.bouncycastle:bcprov-jdk18on	< 1.75-root.io.5 < 1.77-root.io.4 < 1.83-root.io.5 Fix: upgrade to 1.75-root.io.5
Root:Maven	bouncycastle	org.bouncycastle:bcprov-jdk18on	< 1.75-aikido.5 < 1.77-aikido.4 < 1.83-aikido.5 Fix: upgrade to 1.75-aikido.5
Root:Maven	–	org.bouncycastle:bcprov-jdk18on	< 1.77-aikido.4 < 1.80-aikido.12 Fix: upgrade to 1.77-aikido.4
Root:Maven	–	io.root.org.bouncycastle:bcprov-jdk18on	< 1.77-root.io.4 < 1.80-root.io.12 Fix: upgrade to 1.77-root.io.4
Root:Maven	–	org.bouncycastle:bcprov-jdk15to18	< 1.68-aikido.1 Fix: upgrade to 1.68-aikido.1
Root:Maven	–	io.root.org.bouncycastle:bcprov-jdk15to18	< 1.68-root.io.1 Fix: upgrade to 1.68-root.io.1
maven	–	org.bouncycastle:bcprov-jdk14	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.84
maven	–	org.bouncycastle:bcprov-jdk15to18	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.84
maven	–	org.bouncycastle:bcprov-jdk18on	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.80.2
maven	–	org.bouncycastle:bcprov-debug-jdk14	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.84
maven	–	org.bouncycastle:bcprov-debug-jdk15to18	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.84
maven	–	org.bouncycastle:bcprov-debug-jdk18on	>= 1.59, <= 1.80.1 1.81.0 >= 1.82, <= 1.83 Fix: upgrade to 1.84
maven	–	org.bouncycastle:bcprov-ext-jdk14	>= 1.59, <= 1.78.1
maven	–	org.bouncycastle:bcprov-ext-jdk15to18	>= 1.59, <= 1.78.1
maven	–	org.bouncycastle:bcprov-ext-jdk18on	>= 1.59, <= 1.78.1
maven	–	org.bouncycastle:bcprov-ext-debug-jdk14	>= 1.59, <= 1.74
maven	–	org.bouncycastle:bcprov-ext-debug-jdk15to18	>= 1.59, <= 1.77
maven	–	org.bouncycastle:bcprov-ext-debug-jdk18on	>= 1.59, <= 1.77
maven	–	org.bouncycastle:bcprov-debug-jdk15on	<= 1.7.0
maven	–	org.bouncycastle:bcprov-jdk15on	<= 1.7.0
Maven	–	org.bouncycastle:bcprov-jdk18on	>= 1.59, < 1.80.2 >= 1.81.0, < 1.81.1 >= 1.82, < 1.84 Fix: upgrade to 1.80.2
Maven	–	org.bouncycastle:bcprov-jdk14	>= 1.82, < 1.84 Fix: upgrade to 1.84
Maven	–	org.bouncycastle:bcprov-jdk15to18	>= 1.82, < 1.84 Fix: upgrade to 1.84
Maven	–	org.bouncycastle:bcprov-debug-jdk14	>= 1.82, < 1.84 Fix: upgrade to 1.84
Maven	–	org.bouncycastle:bcprov-debug-jdk15to18	>= 1.82, < 1.84 Fix: upgrade to 1.84
Maven	–	org.bouncycastle:bcprov-debug-jdk18on	>= 1.82, < 1.84 Fix: upgrade to 1.84

Original advisory text

GOSTCTR implementation unable to process more than 255 blocks correctly

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).

This vulnerability is associated with program files G3413CTRBlockCipher.

This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

References

https://access.redhat.com/errata/RHSA-2026:60251 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:60252 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:60254 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-14813 Vendor Advisory
https://github.com/bcgit/bc-java Product
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json URL
https://access.redhat.com/errata/RHSA-2026:53806 URL
https://access.redhat.com/errata/RHSA-2026:60259 Vendor Advisory
https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3 Patch
https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f Patch
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:14276 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:17668 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:18054 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:18055 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:18059 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:21772 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:24977 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:53644 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:53645 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:53646 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:60239 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:60246 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:60247 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:60248 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:60249 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:60250 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2458640 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:11721 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13631 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:14272 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:66488 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-14813 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:11720 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:60256 Vendor Advisory
https://github.com/advisories/GHSA-574f-3g2m-x479
https://www.bouncycastle.org/download/bouncy-castle-java/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14813... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-327Use of a Broken Cryptographic Algorithm

CWE-323Reusing a Nonce, Key Pair in Encryption

Timeline

Published15 Apr 2026

Updated2 Oct 2026

First seen17 Apr 2026

Sources

ROOT-APP-MAVEN-CVE-2025-14813 · OSV

CVE-2025-14813 · NVD

GHSA-574f-3g2m-x479 · GHSA

GHSA-574f-3g2m-x479 · OSV

CVE-2025-14813 · MITRE

CVE-2025-14813 · OSV

Track software like this

Free during beta