# CVE-2025-14813: Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks > CVE-2025-14813 (GitHub advisory GHSA-574f-3g2m-x479) is a critical-severity vulnerability with a CVSS 4.0 base score of 9.3, classed as Reusing a Nonce, Key Pair in Encryption (CWE-323), in 14 packages, including org.bouncycastle:bcprov-jdk14 (Maven) and org.bouncycastle:bcprov-jdk15to18 (Maven). Fixed versions: org.bouncycastle:bcprov-jdk14 1.84; org.bouncycastle:bcprov-jdk15to18 1.84; and 4 more packages. Canonical page: https://cveminer.com/vulnerabilities/CVE-2025-14813 | Field | Value | | --- | --- | | CVE | CVE-2025-14813 | | GHSA | GHSA-574f-3g2m-x479 | | Severity | Critical | | CVSS 4.0 | 9.3 `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red` (GitHub Advisory Database) | | CVSS 3.1 | 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` (GitHub Advisory Database) | | CWE | CWE-323 Reusing a Nonce, Key Pair in Encryption; CWE-327 Use of a Broken or Risky Cryptographic Algorithm | | EPSS | 0.32% (higher than 22% of CVEs) | | CISA KEV | Not listed | | SSVC | exploitation none, automatable no, technical impact total | | Published | 15 Apr 2026 | | Modified | 24 Sept 2026 | ## Description The GOST 28147-2015 CTR mode implementation (`G3413CTRBlockCipher`) in the Legion of the Bouncy Castle BC-JAVA `bcprov` core module only increments the final byte of the counter, so the counter wraps after 255 blocks and the keystream is reused. Reusing CTR keystream allows an attacker who can observe two ciphertexts produced with the same key/IV to recover the XOR of the plaintexts, breaking confidentiality. Affects BC-JAVA from 1.59 before 1.84 (with backported fixes in 1.80.2 and 1.81.1). ## Affected packages | Package | Ecosystem | PURL | Vulnerable versions | Fixed in | | --- | --- | --- | --- | --- | | org.bouncycastle:bcprov-jdk14 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk14` | >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83 | 1.84 | | org.bouncycastle:bcprov-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk15to18` | >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83 | 1.84 | | org.bouncycastle:bcprov-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk18on` | >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83 | 1.80.2, 1.81.1, 1.84 | | org.bouncycastle:bcprov-debug-jdk14 | Maven | `pkg:maven/org.bouncycastle/bcprov-debug-jdk14` | >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83 | 1.84 | | org.bouncycastle:bcprov-debug-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18` | >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83 | 1.84 | | org.bouncycastle:bcprov-debug-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcprov-debug-jdk18on` | >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83 | 1.84 | | org.bouncycastle:bcprov-ext-jdk14 | Maven | `pkg:maven/org.bouncycastle/bcprov-ext-jdk14` | >= 1.59, <= 1.78.1 | no fix | | org.bouncycastle:bcprov-ext-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcprov-ext-jdk15to18` | >= 1.59, <= 1.78.1 | no fix | | org.bouncycastle:bcprov-ext-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcprov-ext-jdk18on` | >= 1.59, <= 1.78.1 | no fix | | org.bouncycastle:bcprov-ext-debug-jdk14 | Maven | `pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk14` | >= 1.59, <= 1.74 | no fix | | org.bouncycastle:bcprov-ext-debug-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15to18` | >= 1.59, <= 1.77 | no fix | | org.bouncycastle:bcprov-ext-debug-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk18on` | >= 1.59, <= 1.77 | no fix | | org.bouncycastle:bcprov-debug-jdk15on | Maven | `pkg:maven/org.bouncycastle/bcprov-debug-jdk15on` | <= 1.7.0 | no fix | | org.bouncycastle:bcprov-jdk15on | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk15on` | <= 1.7.0 | no fix | ## Fix commits - Patch: https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f - Patch: https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3 - Release: https://github.com/bcgit/bc-java/commit/d3fbd45fd5e27fbc3a69b8ab150619f0dc8a6a44 (1.80.2) - Release: https://github.com/bcgit/bc-java/commit/dd0e7f83eef6b5d157139c9da21852d44bfcef71 (1.81.1) - Release: https://github.com/bcgit/bc-java/commit/d716d7716a452bad283323aefd88ff21eba8deef (1.84) ## Questions **What is the GHSA ID for CVE-2025-14813?** GitHub tracks CVE-2025-14813 as GHSA-574f-3g2m-x479. **What is the CVSS score of CVE-2025-14813?** CVE-2025-14813 has a CVSS 4.0 base score of 9.3 (Critical), vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red. Other published scores: CVSS 3.1 7.5. **Which versions are affected by CVE-2025-14813?** org.bouncycastle:bcprov-jdk14 (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. org.bouncycastle:bcprov-jdk15to18 (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. org.bouncycastle:bcprov-jdk18on (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. org.bouncycastle:bcprov-debug-jdk14 (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. org.bouncycastle:bcprov-debug-jdk15to18 (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. org.bouncycastle:bcprov-debug-jdk18on (Maven): >= 1.59, <= 1.80.1; = 1.81.0; >= 1.82, <= 1.83. 8 more packages are listed on the page. **How do I fix CVE-2025-14813?** Upgrade each package to its fixed version: org.bouncycastle:bcprov-jdk14 1.84; org.bouncycastle:bcprov-jdk15to18 1.84; org.bouncycastle:bcprov-jdk18on 1.80.2, 1.81.1 or 1.84; org.bouncycastle:bcprov-debug-jdk14 1.84; and 2 more packages. The fix is in commits b425743 and 701686c. **What is the Package URL (PURL) for CVE-2025-14813?** The affected packages' PURLs are pkg:maven/org.bouncycastle/bcprov-jdk14, pkg:maven/org.bouncycastle/bcprov-jdk15to18, pkg:maven/org.bouncycastle/bcprov-jdk18on, pkg:maven/org.bouncycastle/bcprov-debug-jdk14, pkg:maven/org.bouncycastle/bcprov-debug-jdk15to18 and pkg:maven/org.bouncycastle/bcprov-debug-jdk18on and more. **Is CVE-2025-14813 exploited in the wild?** CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-14813. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 22% of CVEs. ## References - https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f (fix) - https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3 (fix) - https://nvd.nist.gov/vuln/detail/CVE-2025-14813 (advisory) - https://access.redhat.com/errata/RHSA-2026:11720 (advisory) - https://access.redhat.com/errata/RHSA-2026:60248 (advisory) - https://access.redhat.com/errata/RHSA-2026:60249 (advisory) - https://access.redhat.com/errata/RHSA-2026:60250 (advisory) - https://access.redhat.com/errata/RHSA-2026:60251 (advisory) - https://access.redhat.com/errata/RHSA-2026:60252 (advisory) - https://access.redhat.com/errata/RHSA-2026:60254 (advisory) - https://access.redhat.com/errata/RHSA-2026:60256 (advisory) - https://access.redhat.com/errata/RHSA-2026:60259 (advisory) - https://access.redhat.com/errata/RHSA-2026:66488 (advisory) - https://access.redhat.com/security/cve/CVE-2025-14813 (advisory) - https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813 (advisory) - https://access.redhat.com/errata/RHSA-2026:11721 (advisory) - https://access.redhat.com/errata/RHSA-2026:13631 (advisory) - https://access.redhat.com/errata/RHSA-2026:14272 (advisory) - https://access.redhat.com/errata/RHSA-2026:14276 (advisory) - https://access.redhat.com/errata/RHSA-2026:17668 (advisory) - https://access.redhat.com/errata/RHSA-2026:18054 (advisory) - https://access.redhat.com/errata/RHSA-2026:18055 (advisory) - https://access.redhat.com/errata/RHSA-2026:18059 (advisory) - https://access.redhat.com/errata/RHSA-2026:21772 (advisory) - https://access.redhat.com/errata/RHSA-2026:24977 (advisory) - https://access.redhat.com/errata/RHSA-2026:53644 (advisory) - https://access.redhat.com/errata/RHSA-2026:53645 (advisory) - https://access.redhat.com/errata/RHSA-2026:53646 (advisory) - https://access.redhat.com/errata/RHSA-2026:60239 (advisory) - https://access.redhat.com/errata/RHSA-2026:60246 (advisory) - https://access.redhat.com/errata/RHSA-2026:60247 (advisory) - https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14813.json (advisory) - https://github.com/advisories/GHSA-574f-3g2m-x479 (advisory) - https://bugzilla.redhat.com/show_bug.cgi?id=2458640 (report) - https://github.com/bcgit/bc-java (package) - https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json - https://access.redhat.com/errata/RHSA-2026:53806 - https://www.bouncycastle.org/download/bouncy-castle-java/ --- Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2025-14813), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.