CVE-2025-14813

GOSTCTR implementation unable to process more than 255 blocks correctly

HIGH

7.5

CVSS Score

Published: April 15, 2026 at 08:56 AM UTC

Updated: October 7, 2026 at 09:10 AM UTC

13 products affected across 2 vendorsEnterprise LinuxJBoss Enterprise Application PlatformSingle Sign on

Using BC-JAVA by Legion of the Bouncy Castle Inc.?

Get instant alerts when new vulnerabilities affect BC-JAVA - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. GOSTCTR implementation unable to process more than 255 blocks correctly. This issue affects BC-JAVA: from 1.59 before 1.84.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

BC Java · Legion of Bouncy Castlemaven

60%

1.59 ≤ v < 1.80.21.81 ≤ v < 1.81.11.82 ≤ v < 1.841.59 1.81 1.82

Affected range stops below 1.80.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.81.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.84, so it looks safe — our inference, not a vendor statement

Build of Apache Camel for Quarkus · Red Hatrpm

60%

Build of Debezium · Red Hatrpm

60%

Build of Keycloak · Red Hatcontainer

60%

All versions

Enterprise Linux · Red Hatrpm

60%

Vendor states this is fixed in 8 (unaffected)

Vendor states this is fixed in 9 (unaffected)

Fuse · Red Hatrpm

60%

JBoss Amq Clients · Red Hatrpm

60%

All versions

JBoss Enterprise Application Platform · Red Hatrpm

60%

Vendor states this is fixed in 0:1.10.0-46.Final_redhat_00044.1.el7eap (unaffected)

Vendor states this is fixed in 0:1.10.0-46.Final_redhat_00044.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.10.0-46.Final_redhat_00044.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.5.26-2.Final_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:1.5.26-2.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.5.26-2.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.84.0-1.redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.84.0-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.16.0-22.redhat_00057.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.16.0-22.redhat_00057.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.16.0-22.redhat_00057.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.18.8-1.redhat_00003.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.18.8-1.redhat_00003.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.18.8-1.redhat_00003.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.2.40-1.SP3_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.2.40-1.SP3_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.2.40-2.SP3_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.3.14-11.SP11_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.3.14-11.SP11_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.3.14-11.SP11_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.5.5-24.SP12_redhat_00016.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.5.5-24.SP12_redhat_00016.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.5.5-24.SP12_redhat_00016.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.5.5-30.SP12_redhat_00020.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.5.5-30.SP12_redhat_00020.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.5.5-30.SP12_redhat_00020.1.el9eap (unaffected)

Vendor states this is fixed in 0:4.1.135-1.Final_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:4.1.135-1.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:4.1.135-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:5.0.31-3.SP2_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:5.0.31-3.SP2_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:5.0.31-3.SP2_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:7.4.25-2.GA_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:7.4.25-2.GA_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:7.4.25-2.GA_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 1.84.0.redhat-1 (unaffected)

OpenShift AI · Red Hatcontainer

60%

All versions

Vendor states this is fixed in 1780069506 (unaffected)

OpenShift Developer Tools and Services · Red Hatrpm

60%

All versions

Vendor states this is fixed in 1786533561 (unaffected)

Vendor states this is fixed in 1786533565 (unaffected)

Vendor states this is fixed in 1786628667 (unaffected)

Vendor states this is fixed in 1786628681 (unaffected)

Vendor states this is fixed in 1787124632 (unaffected)

Vendor states this is fixed in 1787124635 (unaffected)

Vendor states this is fixed in 1787124779 (unaffected)

Vendor states this is fixed in 1787124925 (unaffected)

Vendor states this is fixed in 1787125069 (unaffected)

Vendor states this is fixed in 1787125166 (unaffected)

Vendor states this is fixed in 1787125311 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (33)

Vendor Advisory

Source: cverecord

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813

Patch

Source: cverecord

https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f

Patch

Source: cverecord

https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3