Skip to content
CVE IDCVE-2025-14813GitHub advisory IDGHSA-574f-3g2m-x479

Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

CVE-2025-14813 (GitHub advisory GHSA-574f-3g2m-x479) is a critical-severity vulnerability with a CVSS 4.0 base score of 9.3, classed as Reusing a Nonce, Key Pair in Encryption (CWE-323), in 14 packages, including org.bouncycastle:bcprov-jdk14 (Maven) and org.bouncycastle:bcprov-jdk15to18 (Maven). Fixed versions: org.bouncycastle:bcprov-jdk14 1.84; org.bouncycastle:bcprov-jdk15to18 1.84; and 4 more packages.

Critical9.3Fix availableGitHub reviewed

Published 15 Apr 2026Updated 24 Sept 2026

9.3CriticalCVSS 4.0
CVE ID
CVE-2025-14813
GHSA ID
GHSA-574f-3g2m-x479
EPSS
0.32%higher than 22% of CVEs
Weaknesses (CWE)
  • CWE-323Reusing a Nonce, Key Pair in Encryption
  • CWE-327Use of a Broken or Risky Cryptographic Algorithm
KEV status
Not in KEV
Published
15 Apr 2026
Updated
24 Sept 2026
Ecosystem
  • Maven
Assigned by (CNA)
bcorg

Summary

Source: OSV (GitHub advisory)

The GOST 28147-2015 CTR mode implementation (G3413CTRBlockCipher) in the Legion of the Bouncy Castle BC-JAVA bcprov core module only increments the final byte of the counter, so the counter wraps after 255 blocks and the keystream is reused. Reusing CTR keystream allows an attacker who can observe two ciphertexts produced with the same key/IV to recover the XOR of the plaintexts, breaking confidentiality. Affects BC-JAVA from 1.59 before 1.84 (with backported fixes in 1.80.2 and 1.81.1).

Technical details

Source: GitHub Advisory Database

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red

Critical9.3Base score from GitHub Advisory Database

Attack Vector AV
Local
Attack Complexity AC
Low
Attack Requirements AT
None
Privileges Required PR
None
User Interaction UI
None
Confidentiality (Vulnerable System) VC
High
Integrity (Vulnerable System) VI
High
Availability (Vulnerable System) VA
None
Confidentiality (Subsequent Systems) SC
High
Integrity (Subsequent Systems) SI
High
Availability (Subsequent Systems) SA
None
Vulnerability Response Effort RE
Moderate
Provider Urgency U
Red

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
no
Needs manual steps per target
Technical impact
total
Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • org.bouncycastle:bcprov-jdk14
    Maven
    pkg:maven/org.bouncycastle/bcprov-jdk14
    Affected versions
    >= 1.59, <= 1.80.1
    = 1.81.0
    >= 1.82, <= 1.83
    Fixed in
    1.84
    Show 25 listed versions
    • 1.59
    • 1.60
    • 1.61
    • 1.62
    • 1.63
    • 1.64
    • 1.65
    • 1.67
    • 1.68
    • 1.69
    • 1.70
    • 1.71
  • org.bouncycastle:bcprov-jdk15to18
    Maven
    pkg:maven/org.bouncycastle/bcprov-jdk15to18
    Affected versions
    >= 1.59, <= 1.80.1
    = 1.81.0
    >= 1.82, <= 1.83
    Fixed in
    1.84
    Show 22 listed versions
    • 1.63
    • 1.64
    • 1.65
    • 1.66
    • 1.67
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
    • 1.74
  • org.bouncycastle:bcprov-jdk18on
    Maven
    pkg:maven/org.bouncycastle/bcprov-jdk18on
    Affected versions
    >= 1.59, <= 1.80.1
    = 1.81.0
    >= 1.82, <= 1.83
    Fixed in
    1.80.2
    1.81.1
    1.84
    Show 16 listed versions
    • 1.71
    • 1.71.1
    • 1.72
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
    • 1.78
    • 1.78.1
    • 1.79
    • 1.80
  • org.bouncycastle:bcprov-debug-jdk14
    Maven
    pkg:maven/org.bouncycastle/bcprov-debug-jdk14
    Affected versions
    >= 1.59, <= 1.80.1
    = 1.81.0
    >= 1.82, <= 1.83
    Fixed in
    1.84
    Show 16 listed versions
    • 1.59
    • 1.60
    • 1.64
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
    • 1.74
    • 1.78
    • 1.79
  • org.bouncycastle:bcprov-debug-jdk15to18
    Maven
    pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18
    Affected versions
    >= 1.59, <= 1.80.1
    = 1.81.0
    >= 1.82, <= 1.83
    Fixed in
    1.84
    Show 17 listed versions
    • 1.64
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
    • 1.78
  • org.bouncycastle:bcprov-debug-jdk18on
    Maven
    pkg:maven/org.bouncycastle/bcprov-debug-jdk18on
    Affected versions
    >= 1.59, <= 1.80.1
    = 1.81.0
    >= 1.82, <= 1.83
    Fixed in
    1.84
    Show 13 listed versions
    • 1.71
    • 1.72
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
    • 1.78
    • 1.78.1
    • 1.79
    • 1.81.0
    • 1.82
  • org.bouncycastle:bcprov-ext-jdk14
    Maven
    pkg:maven/org.bouncycastle/bcprov-ext-jdk14
    Affected versions
    >= 1.59, <= 1.78.1
    Fixed in
    None after 1.78.1
    Show 14 listed versions
    • 1.60
    • 1.64
    • 1.65
    • 1.67
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
    • 1.75
    • 1.76
  • org.bouncycastle:bcprov-ext-jdk15to18
    Maven
    pkg:maven/org.bouncycastle/bcprov-ext-jdk15to18
    Affected versions
    >= 1.59, <= 1.78.1
    Fixed in
    None after 1.78.1
    Show 14 listed versions
    • 1.64
    • 1.67
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
  • org.bouncycastle:bcprov-ext-jdk18on
    Maven
    pkg:maven/org.bouncycastle/bcprov-ext-jdk18on
    Affected versions
    >= 1.59, <= 1.78.1
    Fixed in
    None after 1.78.1
    Show 9 listed versions
    • 1.71
    • 1.72
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
    • 1.78
    • 1.78.1
  • org.bouncycastle:bcprov-ext-debug-jdk14
    Maven
    pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk14
    Affected versions
    >= 1.59, <= 1.74
    Fixed in
    None after 1.74
    Show 8 listed versions
    • 1.60
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
    • 1.74
  • org.bouncycastle:bcprov-ext-debug-jdk15to18
    Maven
    pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15to18
    Affected versions
    >= 1.59, <= 1.77
    Fixed in
    None after 1.77
    Show 10 listed versions
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
  • org.bouncycastle:bcprov-ext-debug-jdk18on
    Maven
    pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk18on
    Affected versions
    >= 1.59, <= 1.77
    Fixed in
    None after 1.77
    Show 7 listed versions
    • 1.71
    • 1.72
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
  • org.bouncycastle:bcprov-debug-jdk15on
    Maven
    pkg:maven/org.bouncycastle/bcprov-debug-jdk15on
    Affected versions
    <= 1.7.0
    Fixed in
    None after 1.7.0
  • org.bouncycastle:bcprov-jdk15on
    Maven
    pkg:maven/org.bouncycastle/bcprov-jdk15on
    Affected versions
    <= 1.7.0
    Fixed in
    None after 1.7.0

Fix

Source: OSV (GitHub advisory)

Fix available

  • org.bouncycastle:bcprov-jdk14: upgrade to 1.84 or later
  • org.bouncycastle:bcprov-jdk15to18: upgrade to 1.84 or later
  • org.bouncycastle:bcprov-jdk18on: upgrade to 1.80.2, 1.81.1 or 1.84, depending on your release line
  • org.bouncycastle:bcprov-debug-jdk14: upgrade to 1.84 or later
  • org.bouncycastle:bcprov-debug-jdk15to18: upgrade to 1.84 or later
  • org.bouncycastle:bcprov-debug-jdk18on: upgrade to 1.84 or later

Not fixed yet for: org.bouncycastle:bcprov-ext-jdk14, org.bouncycastle:bcprov-ext-jdk15to18, org.bouncycastle:bcprov-ext-jdk18on, org.bouncycastle:bcprov-ext-debug-jdk14, org.bouncycastle:bcprov-ext-debug-jdk15to18, org.bouncycastle:bcprov-ext-debug-jdk18on, org.bouncycastle:bcprov-debug-jdk15on, org.bouncycastle:bcprov-jdk15on.

Patch commits

  • b425743Patch commitgithub.com/bcgit/bc-java

    refactored counter code.

    +71 −9 across 2 files

    • core/src/main/java/org/bouncycastle/crypto/modes/G3413CTRBlockCipher.java+12 −8
    • core/src/test/java/org/bouncycastle/crypto/test/GOST3412Test.java+59 −1
  • 701686cPatch commitgithub.com/bcgit/bc-java

    fixed one off error in G3413CTRBlockCipher

    +2 −4 across 2 files

    • core/src/main/java/org/bouncycastle/crypto/modes/G3413CTRBlockCipher.java+1 −3
    • core/src/test/java/org/bouncycastle/crypto/test/GOST3412Test.java+1 −1

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • d3fbd45Release commit1.80.2github.com/bcgit/bc-java
  • dd0e7f8Release commit1.81.1github.com/bcgit/bc-java
  • d716d77Release commit1.84github.com/bcgit/bc-java

Vulnerability intelligence

References

Credits

  • simon-reisinger-dynatraceanalyst
  • XlabAI Team of Tencent Xuanwu Labfinder
  • Atuin Automated Vulnerability Discovery Enginefinder
  • Lili Tang, Guannan Wang, and Guancheng Lifinder

Questions about CVE-2025-14813

What is the GHSA ID for CVE-2025-14813?
GitHub tracks CVE-2025-14813 as GHSA-574f-3g2m-x479.
What is the CVSS score of CVE-2025-14813?
CVE-2025-14813 has a CVSS 4.0 base score of 9.3 (Critical), vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red. Other published scores: CVSS 3.1 7.5.
Which versions are affected by CVE-2025-14813?
org.bouncycastle:bcprov-jdk14 (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. org.bouncycastle:bcprov-jdk15to18 (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. org.bouncycastle:bcprov-jdk18on (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. org.bouncycastle:bcprov-debug-jdk14 (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. org.bouncycastle:bcprov-debug-jdk15to18 (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. org.bouncycastle:bcprov-debug-jdk18on (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. 8 more packages are listed on the page.
How do I fix CVE-2025-14813?
Upgrade each package to its fixed version: org.bouncycastle:bcprov-jdk14 1.84; org.bouncycastle:bcprov-jdk15to18 1.84; org.bouncycastle:bcprov-jdk18on 1.80.2, 1.81.1 or 1.84; org.bouncycastle:bcprov-debug-jdk14 1.84; and 2 more packages. The fix is in commits b425743 and 701686c.
What is the Package URL (PURL) for CVE-2025-14813?
The affected packages' PURLs are pkg:maven/org.bouncycastle/bcprov-jdk14, pkg:maven/org.bouncycastle/bcprov-jdk15to18, pkg:maven/org.bouncycastle/bcprov-jdk18on, pkg:maven/org.bouncycastle/bcprov-debug-jdk14, pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18 and pkg:maven/org.bouncycastle/bcprov-debug-jdk18on and more.
Is CVE-2025-14813 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-14813. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 22% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 1 day ago (14 Oct 2026, 00:55 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.